Authentication

​

Authentication Flow

1. Obtain your API key during Account Setup
2. Exchange your API key for a JWT token using the /auth/token endpoint
3. Include the token in the Authorization header on every API request

​

Get a JWT Token

curl -X POST https://cra.pr.snh-ai.com/auth/token \
  -H "X-API-Key: $PR_API_KEY" \
  -H "Content-Type: application/json"

import requests, os

base = os.environ["PR_API_BASE"]
api_key = os.environ["PR_API_KEY"]

resp = requests.post(
    f"{base}/auth/token",
    headers={"X-API-Key": api_key}
)
token = resp.json()["access_token"]

const base = process.env.PR_API_BASE;
const apiKey = process.env.PR_API_KEY;

const resp = await fetch(`${base}/auth/token`, {
  method: "POST",
  headers: { "X-API-Key": apiKey }
});
const { access_token } = await resp.json();

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "bearer",
  "expires_in": 3600
}

• Token lifetime is returned in expires_in (seconds). Current environments use 1 hour (3600); always read expires_in rather than hard-coding a duration
• Tokens cannot be refreshed or extended — request a new one before expiry

​

Use the Token

Authorization: Bearer YOUR_TOKEN_HERE

​

Error Responses

​

Best Practices

1. Token Management:
   • Cache tokens and refresh before expiration
   • Handle 401 errors by requesting a new token
   • Never hardcode tokens
2. Security:
   • Never expose API keys in client-side code
   • Use environment variables for API keys
   • Rotate API keys periodically
3. Error Handling:
   • Always check response status codes
   • Implement retry logic for 401 errors — see Retry Logic
   • Log authentication errors for debugging