Every request to https://platform.jobbit.uk/v1 must carry a key in the Authorization header. A request without one, or with a key that is wrong, revoked or expired, gets 401 invalid_key.

​
API keys

Create a key in Settings → API keys and send it as a bearer token: 
curl https://platform.jobbit.uk/v1/key \
  -H "Authorization: Bearer jb_live_k7m2p9x4qa1c_Vq8ZtR2mWx4LpN9sKd7HbY3cJf6GwE1uTa5Xf3Qd"
A key has the form jb_live_<id>_<secret>. The id part is public and shows in your key list and in logs; the secret after it is what proves the key. Jobbit stores only a fingerprint of the secret, so it cannot show a key again. A key acts for the person who created it. It sees that person’s apps, files, tasks and balance, and spends that person’s credits, always within the key’s permissions and limits.

​
What can make a key stop working

AnswerWhy
401 invalid_keyThe key is missing, mistyped, revoked or past its expiry date
403 ip_not_allowedThe key has an IP allowlist and the request came from another address
403 insufficient_scopeThe key lacks the permission the route needs; the message names it
403 key_spend_limitThe key reached its credit cap for the day or month
403 account_unavailableThe account is banned or deactivated; every key of it stops at once
429 too_many_failed_attemptsTwenty failed sign-ins from one address within 5 minutes block that address for 15 minutes

​
OAuth for MCP clients

Apps that connect over MCP, such as Claude, ChatGPT, Codex and Cursor, can sign in with OAuth instead of a key you paste. Nothing has to be set up in advance:
1

The client finds the sign-in

The client calls https://platform.jobbit.uk/mcp without a token and gets 401 with a WWW-Authenticate header. It follows it to /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server.
2

It registers itself

The client registers with POST /oauth/register and sends you to /oauth/authorize with PKCE (S256).
3

You approve it in Jobbit

Jobbit shows the app, where it will send you back and the permissions it asks for. You can untick any permission before you approve.
4

The client gets tokens

The client swaps the code at POST /oauth/token for an access token that lives an hour and a refresh token. Refreshing gives a new pair.
Without requested scopes a client gets every permission except deploy:admin and billing:write. The connection shows in Settings → Integrations and as a key named after the app, for example Claude (OAuth), in your API keys. Disconnecting it in either place ends it, and the app’s next call gets 401. A connection unused for 90 days lapses, and you sign the app in again.

​
Good practice

  • Keep keys on the server. Never put a key in a browser, a mobile app or a public repository; /v1 routes do not allow cross-origin browser calls.
  • Read keys from the environment, for example JOBBIT_API_KEY, rather than from code or config files you commit.
  • Use one key per app or integration so you can revoke one without touching the rest.
  • Call GET /v1/key when your program starts to check that the key works and has the permissions it needs.