Overview
The Puppeteer API uses two authentication methods depending on the context:
- API Keys for server-to-server calls (organization-scoped)
- JWT Tokens for client-side and thread-scoped access
API Key
Pass your API key in the Authorization header:
API keys are scoped to an organization and grant access to all projects within it.
Keep your API key secret. Never expose it in client-side code or public repositories.
JWT Token
For client-facing integrations, generate a short-lived JWT token scoped to a specific thread:
Use the returned token in place of your API key for subsequent requests on that thread. JWT tokens are ideal for chat widgets and end-user-facing applications where you don’t want to expose your API key.
