Authentication
The API authenticates with bearer Personal Access Tokens. Browser sessions use HttpOnly cookies; PATs are the mechanism for scripts, SDKs and integrations.
The header, as it goes
header
Authorization: Bearer pjk_live_xxxxxxxxxxxxxxxxxxxxHow far a token reaches
A PAT is issued INSIDE an organization and only reaches that one’s resources. Membership is resolved on the server from the id in the path: an id sent by the client is never trusted. A non-member gets a 404, not a 403 — not even the existence of the resource leaks. Creating and revoking keys requires the owner or admin role.
Five habits that save you a bad day
- The token is shown once, when you create it; only its hash is stored. There is no way to recover it later.
- Keep it in a secret manager or an environment variable. Never commit it.
- If it leaks, revoke it under Settings → API keys before investigating anything else.
- Use one token per integration, so you can revoke one without taking down the rest.
- Always send it over HTTPS.