Authentication

Every /v1 endpoint requires an Authorization: Bearer <token> header. Tokens start with the prefix jdo_ and are issued by a Jade administrator.

Example request 

curl /api/v1/participants \
  -H "Authorization: Bearer jdo_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Token lifecycle

  • Plaintext is shown once. When an administrator issues your token, the full value appears exactly once. Jade stores only the SHA-256 hash — there is no recovery flow. If you lose it, ask for a new one.
  • The first 8 characters after jdo_ are your prefix. Share this freely; it identifies the token without revealing the secret.
  • Rotation is non-disruptive. An administrator can issue a new token while the old one is still live, then revoke the old one once you've cut over. Multiple tokens may coexist on the same account.
  • Revocation is immediate. A revoked token fails on the next request — there is no caching window.
  • Expiry is optional.Tokens may carry an expiresAt; absent means no expiry.

What does NOT use a bearer token

The participant pre-registration endpoint POST /public/event/{eventCode}/participant/external-register is anonymous and uses IP-based rate limiting instead. See the external-register guide.

MCP endpoints

The participant MCP endpoint (/api/mcp/participant) uses the same bearer scheme, but the token’s API account must also have canActAsParticipantAgent: true. The flag is off by default, so only accounts provisioned for it can reach the endpoint; a Jade administrator turns it on under Developers → API Accounts. Once the person being registered has confirmed their email with a one-time code, each call also carries an X-Participant-Session header. See Connect an AI assistant (participants).

The organizer MCP endpoint (/api/mcp/organizer) takes no API account and no jdo_ token. The organizer signs in with their own Jade login through OAuth 2.1, and the assistant sends the access token it receives as its bearer token. See Connect an AI assistant (organizers).

Error responses

  • 401 Unauthorized — missing, malformed, revoked, or expired token. Re-check the header format.
  • 403 Forbidden — token is valid, but the request named a client or event outside its scope.