Authentication

Every Jitra Public API endpoint requires an API key issued for your Organization.

Send the API key

Use either authentication method. Both carry the same Organization API key.

curl --request GET \
  --url https://api.jitra.app/public/v1/objects \
  --header 'x-api-key: <api_key>'

curl --request GET \
  --url https://api.jitra.app/public/v1/objects \
  --header 'Authorization: Bearer <api_key>'

Send one authentication header per request. You do not need to send both.

A missing, invalid, or expired API key returns 401 Unauthorized.

{
  "statusCode": 401,
  "errorCode": "ERR999",
  "message": "Unauthorized",
  "timestamp": "2026-05-17T01:00:00.000Z"
}

Store API keys in a server-side secrets manager or protected environment variable.
Never commit keys to a repository.
Never expose keys in browser or mobile client code.
Never include keys in URLs, screenshots, or application logs.
Rotate the key from Jitra if it is exposed or compromised.
Use separate keys for separate integrations when your Organization’s setup allows it.

An API key grants access to data available to its Organization. Treat it as a production secret.