Authentication

curl -X GET "https://api.promptreports.ai/v1/prompts" \
  -H "Authorization: Bearer pr_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json"

GET https://promptreports.ai/oauth/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=https://yourapp.com/callback
  &response_type=code
  &scope=prompts:read prompts:write reports:read
  &state=random_state_string

curl -X POST "https://api.promptreports.ai/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "code=AUTHORIZATION_CODE" \
  -d "redirect_uri=https://yourapp.com/callback"

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "rt_xxxxxxxxxxxxxxxxxxxx",
  "scope": "prompts:read prompts:write reports:read"
}

// Header
{
  "alg": "RS256",
  "typ": "JWT",
  "kid": "key-id-123"
}

// Payload
{
  "sub": "user_abc123",
  "iss": "https://api.promptreports.ai",
  "aud": "your-client-id",
  "exp": 1673460389,
  "iat": 1673456789,
  "scope": "prompts:read prompts:write",
  "org_id": "org_xyz789"
}

GET https://api.promptreports.ai/.well-known/jwks.json

import jwt from 'jsonwebtoken';
import jwksClient from 'jwks-rsa';

const client = jwksClient({
  jwksUri: 'https://api.promptreports.ai/.well-known/jwks.json',
  cache: true,
  rateLimit: true,
});

async function verifyToken(token: string) {
  const decoded = jwt.decode(token, { complete: true });
  const key = await client.getSigningKey(decoded.header.kid);

  return jwt.verify(token, key.getPublicKey(), {
    algorithms: ['RS256'],
    issuer: 'https://api.promptreports.ai',
    audience: process.env.CLIENT_ID,
  });
}

X-RateLimit-Limit: 300          # Maximum requests per window
X-RateLimit-Remaining: 245      # Remaining requests in current window
X-RateLimit-Reset: 1673456789   # Unix timestamp when limit resets
X-RateLimit-Policy: 300/minute  # Current rate limit policy
Retry-After: 45                 # Seconds to wait (only on 429 responses)

async function apiRequest(url: string, options: RequestInit) {
  const response = await fetch(url, options);

  if (response.status === 429) {
    const retryAfter = parseInt(response.headers.get('Retry-After') || '60');
    console.log(`Rate limited. Retrying in ${retryAfter} seconds...`);

    await new Promise(resolve => setTimeout(resolve, retryAfter * 1000));
    return apiRequest(url, options); // Retry the request
  }

  // Check remaining quota
  const remaining = parseInt(response.headers.get('X-RateLimit-Remaining') || '0');
  if (remaining < 10) {
    console.warn(`Low API quota: ${remaining} requests remaining`);
  }

  return response;
}

# Never commit this file to version control
PROMPTREPORTS_API_KEY=pr_live_xxxxxxxxxxxxxxxxxxxx
PROMPTREPORTS_CLIENT_ID=client_abc123
PROMPTREPORTS_CLIENT_SECRET=secret_xxxxxxxx
PROMPTREPORTS_WEBHOOK_SECRET=whsec_xxxxxxxx

// Good: Load from environment
const apiKey = process.env.PROMPTREPORTS_API_KEY;

// Bad: Hardcoded credentials
const apiKey = 'pr_live_xxxxxxxxxxxxxxxxxxxx'; // Never do this!

// Verify key is available
if (!apiKey) {
  throw new Error('PROMPTREPORTS_API_KEY environment variable is required');
}

curl -X POST "https://api.promptreports.ai/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "refresh_token=rt_xxxxxxxxxxxxxxxxxxxx"

class TokenManager {
  private accessToken: string;
  private refreshToken: string;
  private expiresAt: number;

  async getValidToken(): Promise<string> {
    // Refresh token 5 minutes before expiration
    if (Date.now() >= this.expiresAt - 300000) {
      await this.refreshAccessToken();
    }
    return this.accessToken;
  }

  private async refreshAccessToken(): Promise<void> {
    const response = await fetch('https://api.promptreports.ai/oauth/token', {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams({
        grant_type: 'refresh_token',
        client_id: process.env.CLIENT_ID!,
        client_secret: process.env.CLIENT_SECRET!,
        refresh_token: this.refreshToken,
      }),
    });

    const data = await response.json();
    this.accessToken = data.access_token;
    this.refreshToken = data.refresh_token || this.refreshToken;
    this.expiresAt = Date.now() + data.expires_in * 1000;
  }
}