Authentication

PromptJang supports two authentication methods:

1. API Keys — for programmatic API access (Authorization: Bearer <key>)
2. Session Tokens — for dashboard access (X-Session-Token: <token>)

Both methods are accepted by all authenticated endpoints.

API Keys

API keys have the format:

pj_live_<8-char-prefix><64-char-hex>

Total length: 72 characters. The prefix allows quick identification in logs and databases.

Key Security

• Keys are never stored in plaintext. Only a one-way hash is retained server-side.
• The full key is returned only once — when you create it. Store it securely.

Managing Keys

Create a Key

curl -X POST https://api.promptjang.net/api/v1/keys \
  -H "Authorization: Bearer pj_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Production key"}'

Response includes the full key (shown only once):

{
  "id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
  "name": "Production key",
  "key": "pj_live_451560fa...",
  "prefix": "pj_live_451560fa",
  "created_at": "2026-05-27T12:00:00Z"
}

List Keys

curl https://api.promptjang.net/api/v1/keys \
  -H "Authorization: Bearer pj_live_YOUR_API_KEY"

Only the prefix is returned (not the full key).

Delete a Key

curl -X DELETE https://api.promptjang.net/api/v1/keys/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 \
  -H "Authorization: Bearer pj_live_YOUR_API_KEY"

You cannot delete your last API key or the key used to authenticate the request.

Authorization Header

Authorization: Bearer pj_live_451560faf7e81b894ff13cdefd27fb0f1017ffbb9721fea67b133c8360360623

This is all you need to send events. No signing required — PromptJang handles outbound signing for you.

Session Tokens

Session tokens are used for dashboard access. They are issued by the auth endpoints and stored in httpOnly cookies by the dashboard.

How Sessions Work

1. User signs up or logs in via POST /api/v1/auth/signup or POST /api/v1/auth/login
2. Backend returns a session_token in the response
3. Dashboard stores it in an httpOnly cookie and sends it as X-Session-Token header
4. Backend validates the session on every request

Session Properties

Property	Value
Duration	7 days
Max per user	5 (oldest evicted)
Storage	Server-side
Revocable	Yes (immediate via DELETE)

Rate Limits

Authentication endpoints have separate rate limits:

Endpoint	Limit	Window
Signup	3 requests	15 minutes (per IP)
Login	5 requests	15 minutes (per IP)