Authentication

Every /v1 endpoint requires an Authorization: Bearer <token> header. Tokens start with the prefix jdo_ and are issued by a Jade administrator.

Example request

curl /api/v1/participants \
  -H "Authorization: Bearer jdo_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Token lifecycle

• Plaintext is shown once. When an administrator issues your token, the full value appears exactly once. Jade stores only the SHA-256 hash — there is no recovery flow. If you lose it, ask for a new one.
• The first 8 characters after jdo_ are your prefix. Share this freely; it identifies the token without revealing the secret.
• Rotation is non-disruptive. An administrator can issue a new token while the old one is still live, then revoke the old one once you've cut over. Multiple tokens may coexist on the same account.
• Revocation is immediate. A revoked token fails on the next request — there is no caching window.
• Expiry is optional. Tokens may carry an expiresAt; absent means no expiry.

What does NOT use a bearer token

The participant pre-registration endpoint POST /public/event/{eventCode}/participant/external-register is anonymous and uses IP-based rate limiting instead. See the external-register guide.

Participant-agent (MCP) bearer flag

The /mcp/participant-agent endpoint uses the same bearer scheme but additionally requires the token's API account to have canActAsParticipantAgent: true. The flag is off by default — your administrator must enable it explicitly so the agent surface can only ever be reached by accounts provisioned for it. See the MCP overview for details on the layered participant-session header.

Error responses

• 401 Unauthorized — missing, malformed, revoked, or expired token. Re-check the header format.
• 403 Forbidden — token is valid, but the request named a client or event outside its scope.