ok found the issue. basically the body of the sign up call should be like this:
{
"email": "johndoe@gmail.com",
"password": "password",
"data": {},
"gotrue_meta_security": { "captcha_token": "" },
"code_challenge": null,
"code_challenge_method": null
}
.jpeg/public)