Authentication
Authenticate with your public API key as a Bearer token.
Every authenticated endpoint requires your public API key as a Bearer token:
curl https://fluid.jetronticket.com/api/v1/events \
-H "Authorization: Bearer jt_public_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"With the SDK, pass it once when creating the client:
import { createClient } from '@jetronticket/api'
const client = createClient({
apiKey: 'jt_public_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
})Host scoping
All events are automatically scoped to the event host that owns the API key. There is no host or tenant parameter to pass. A key can only see and sell its own host's public events.
Key types
Every host has two keys, listed under Manage API Keys in the Jetron Ticket dashboard:
| Key | Where it belongs | What it is for |
|---|---|---|
Public (jt_public_...) | Anywhere, including browser code | Calling this API |
| Private | Your server only, never the browser | Verifying webhook signatures |
The public key is shown in full because it is safe to expose: it only reaches your host's already-public events and the attendee checkout flow. The private key stays masked, and revealing it is deliberate.
The API accepts public keys only:
| Response | Meaning |
|---|---|
401 unauthorized | The key is missing or invalid. |
403 | The key is valid but the wrong type (e.g. a private key). |
Rotating a key
Rotate issues a new key and invalidates the old one immediately, so update anything using it first.
Rotating the private key breaks webhooks
Webhook signatures are generated with your private key, so rotating it means every webhook receiver has to be updated with the new value before it can verify deliveries again.
Only /health is unauthenticated
Every endpoint except GET /health requires a key. Authenticated endpoints are
also rate limited per key.