Authentication

Authentication

Jewel Value separates browser sessions from server-to-server API access.

Long-lived API keys

For server-to-server use:

1. Settings > Security > API Keys
2. Click Generate API Key, give it a name (e.g. "ERP integration")
3. Copy the token shown once — we never display it again
4. Use it as X-API-Key: YOUR_KEY

API keys can be scoped to specific roles (viewer, staff, manager, admin) when generated.

Browser sessions

For interactive use, submit credentials from the Jewel Value web app:

POST /api/v1/auth/login
{ "email": "you@example.com", "password": "..." }
→ { "message": "Login successful", "user": { ... } }

The response sets short-lived access and rotating refresh credentials in Secure, HttpOnly cookies. Browser JavaScript cannot read them. The web app calls POST /auth/refresh when needed; integrations should use a revocable API key instead of copying browser-session credentials.

Tenant scoping

Every authenticated request runs within your tenant. You cannot read or write data from another tenant — the API enforces this server-side regardless of any IDs you pass.

Revoking

API keys can be revoked from the same Security page. Revocation is immediate.