FAQ

What is the difference between the API Key and the Endpoint Secret?

These serve two completely different purposes:

	API Key (pj_live_...)	Endpoint Secret
Who uses it	You → PromptJang	PromptJang → Your target server
Purpose	Authenticate your API calls to PromptJang	Verify that incoming webhooks are genuinely from PromptJang
Sent as	Authorization: Bearer pj_live_...	Never sent directly — used to generate Standard Webhooks signatures
Where to use	Programmatic product and ingestion routes	On your target server to verify webhook signatures

In short: Use the API key to send events. Use the endpoint secret on your receiving server to verify them.

API Key

Programmatic requests and event ingestion can use an API key. Pass it in the Authorization header:

curl -X POST https://api.promptjang.net/e/{endpoint_id} \
  -H "Authorization: Bearer pj_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"event": "order.created", "data": {"order_id": 123}}'

API keys are created in the dashboard. The full key is shown once at creation time — copy it immediately. After that, only the prefix (first 12 characters) is visible.

Endpoint Secret

When PromptJang delivers a webhook to your endpoint, it uses Standard Webhooks v1 with HMAC-SHA256. Verify the webhook-id, webhook-timestamp, and webhook-signature headers with an official Standard Webhooks library. See Webhook Signatures for a complete receiver example and rotation guidance.

Can I retrieve a full API key after creation?

No. API keys are stored as one-way hashes. The full key is only available at the moment of creation. This is the same approach used by Stripe, GitHub, and AWS.

If you lose an API key, revoke it in the dashboard and create a new one.

What happens if delivery fails?

PromptJang retries failed deliveries with exponential backoff. The retry schedule is:

Attempt	Delay
1st retry	60 seconds
2nd retry	120 seconds
3rd retry	240 seconds
4th retry	480 seconds
5th retry	960 seconds

After the initial attempt and five failed retries, the event is marked as EXPIRED and no further retries occur. You can replay expired events from the dashboard.

How does pricing work?

There are no plans or monthly subscription fees. The published rate is $0.10 per 1,000 newly accepted webhook events, mailbox messages, or A2A handoffs. Retries, mailbox reads, claims, acknowledgements, replays, rejected requests, and idempotent duplicates are free. HTTP and MCP use the same price.

Live billing is disabled during the founder-assisted beta. Founder-provisioned workspaces use exempt billing status, can create API keys without connecting a payment method, and still record local usage. Payment activation will become a requirement only after the billing launch gate is enabled.

How do I know my events were delivered?

Every event includes a full delivery log. Check the Events page in the dashboard or use the API:

curl https://api.promptjang.net/api/v1/events/{event_id} \
  -H "Authorization: Bearer pj_live_your_key_here"

The response includes the event status (DELIVERED, FAILED, QUEUED, RETRYING, EXPIRED) and all delivery attempts with HTTP status codes and response bodies.

What status codes do target endpoints need to return?

PromptJang considers any 2xx response as a successful delivery. All other status codes (including 3xx redirects) are treated as failures and will trigger a retry.

Your endpoint should respond quickly — timeouts also count as failures.