Authentication

PromptJang supports two authentication methods:

1. API Keys — for programmatic API access (Authorization: Bearer <key>)
2. Session Tokens — for dashboard access (X-Session-Token: <token>)

Both methods are accepted by authenticated product endpoints. Account activation and payment setup use a session token because a new workspace has no API key yet.

API Keys

API keys have the format:

pj_live_<64-char-hex>

The full key is 72 characters. Key-list responses expose only the first 12 characters, such as pj_live_4515.

Key Security

• Keys are never stored in plaintext. Only a one-way hash is retained server-side.
• The full key is returned only once — when you create it. Store it securely.

Managing Keys

Create a Key

curl -X POST https://api.promptjang.net/api/v1/keys \
  -H "X-Session-Token: YOUR_SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "Production key"}'

Response includes the full key (shown only once):

{
  "id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
  "name": "Production key",
  "key": "pj_live_451560fa..."
}

List Keys

curl https://api.promptjang.net/api/v1/keys \
  -H "Authorization: Bearer pj_live_YOUR_API_KEY"

Only the prefix is returned (not the full key).

Delete a Key

curl -X DELETE https://api.promptjang.net/api/v1/keys/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 \
  -H "Authorization: Bearer pj_live_YOUR_API_KEY"

You cannot delete your last API key or the key used to authenticate the request. A workspace may hold up to five API keys.

Authorization Header

Authorization: Bearer pj_live_YOUR_API_KEY

This is all you need to send events. No signing required — PromptJang handles outbound signing for you.

Session Tokens

Session tokens are used for dashboard access. They are issued by the auth endpoints and stored in httpOnly cookies by the dashboard.

How Sessions Work

1. The founder provisions the workspace and client owner
2. The client owner logs in via POST /api/v1/auth/login
3. Backend returns a session_token in the response
4. Dashboard stores it in an httpOnly cookie and sends it as X-Session-Token header
5. Backend validates the session on every request

Session Properties

Property	Value
Duration	7 days
Max per user	5 (oldest evicted)
Storage	Server-side
Revocable	Yes (immediate via logout routes)

Rate Limits

Authentication endpoints have separate rate limits:

Endpoint	Limit	Window
Login	5 requests	15 minutes (per IP)