Getting started
Authentication
Two credential types. API keys are for everything a machine does; session JWTs exist only so a leaked API key can never mint more keys.
| Credential | Header | Used for |
|---|---|---|
| pc_live_… API key | X-API-Key: pc_live_… or Authorization: Bearer pc_live_… | All data endpoints — events, reports, credits, billing status |
| Session JWT (browser) | Authorization: Bearer <supabase-jwt> | Key management only (mint / list / revoke) |
API keys hit the same endpoints the browser uses — there is no separate namespace. Keys are SHA-256 hashed at rest; the plaintext is shown once at creation. Max 20 live keys per account.
Minting keys
Easiest: the API Keys card in your profile. Programmatically (session JWT required — an API key gets 403 here by design):
curl -X POST https://backend-production-092f.up.railway.app/api/keys \
-H "Authorization: Bearer <supabase-session-jwt>" \
-H "Content-Type: application/json" \
-d '{"name": "my-agent"}'
{"id": "…", "name": "my-agent", "key_prefix": "pc_live_ab",
"key": "pc_live_…", // full plaintext — shown ONCE
"warning": "Store this key now; it cannot be retrieved again."}List / revoke (session-only)
curl https://backend-production-092f.up.railway.app/api/keys -H "Authorization: Bearer <jwt>" curl -X DELETE https://backend-production-092f.up.railway.app/api/keys/KEY_ID -H "Authorization: Bearer <jwt>"
Key hygiene
Treat pc_live_ keys like passwords: environment variables, never client-side code or repos. Revoking is instant. Anything a key did shows up in your report history and credit ledger, so a compromised key is auditable as well as revocable.