🔐

Authentication

Zaki-Pass supports two authentication methods: JWT Bearer Tokens for dashboard sessions and API Keys for server-to-server integration.

🎫

JWT Bearer Token

JWT tokens are used by the Zaki-Pass dashboard and web applications. They are obtained by logging in with email and password, and expire after a set period. Use the refresh token to get a new access token without re-authenticating.

JWT Flow

Register your organization via POST /auth/register
Login with email & password via POST /auth/login
Use the returned accessToken in the Authorization header
When the token expires, use refreshToken via POST /auth/refresh

Header Format

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

cURL

# Login to get tokens
curl -X POST https://api.zakipass.com/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "admin@example.com",
    "password": "your_password"
  }'

# Use the access token
curl https://api.zakipass.com/api/v1/templates \
  -H "Authorization: Bearer eyJhbGciOi..."

🔑

API Key Authentication

API keys are designed for server-to-server integration. They are created from the Zaki-Pass dashboard Settings page and provide scoped access to specific API endpoints. API keys use the X-API-Key header.

• Prefix: zk_ followed by a 32-character unique identifier
• Scoped: Each key can be restricted to specific permissions
• Expirable: Optionally set an expiration date
• Trackable: All API key usage is logged with request details

Header Format

X-API-Key: zk_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6

cURL

curl https://api.zakipass.com/api/v1/passes \
  -H "X-API-Key: zk_your_key_here"

Comparison

Feature	JWT Token	API Key
Best for	Web dashboards, user sessions	Server-to-server, automation
Header	Authorization: Bearer TOKEN	X-API-Key: zk_...
Expires	Short-lived (1h), refreshable	Custom or never
Scope control	Full access	Configurable per key
Rate limit	100 req/min	100 req/min per key
Can create accounts	Yes	No
Can manage users	Yes (role-based)	No

🛡️

Next: Learn about

Scopes & Permissions →