Authentication and scopes

• Keys are stored by PrompTessor as SHA-256 hashes; the full secret is shown once.
• A key may be named, scoped, given an expiration date, edited, revoked, or permanently removed.
• Legacy pt_test_ keys remain accepted until rotated or revoked, but newly created credentials use pt_live_.
• API key limits are plan-based: Pro 3, Pro+ 5, and Max 10 active keys. Equivalent lifetime plans use the same tier limits.

PrompTessor supports the authorization-code flow with PKCE S256, public clients with token endpoint authentication method none, refresh tokens, revocation, protected-resource metadata, authorization-server metadata, JWKS, and dynamic client registration.

Use OAuth when your product needs each PrompTessor user to authorize access to their own account. Server-owned automations that access only one account should normally use a scoped API key instead.

1. 1

   Discover the authorization server

   Fetch the authorization-server metadata and use the advertised authorization, token, registration, revocation, and JWKS endpoints.

2. 2

   Register a public client

   Register one to twenty exact redirect URIs. PrompTessor supports public clients only, so token_endpoint_auth_method must be none and no client secret is issued.

3. 3

   Create PKCE values

   Generate a 43–128 character code_verifier and its base64url SHA-256 code_challenge. Store a separate unpredictable state value in the user session.

4. 4

   Request authorization

   Open /authorize with response_type=code, client_id, redirect_uri, code_challenge, code_challenge_method=S256, scope, state, and resource=https://api.promptessor.com.

5. 5

   Exchange the code

   POST application/x-www-form-urlencoded data to /token with grant_type=authorization_code, the returned code, client_id, the same redirect_uri, and the original code_verifier.

6. 6

   Refresh or revoke

   Rotate refresh tokens through /token with grant_type=refresh_token. When disconnecting, POST the token and client_id to /revoke and delete locally stored credentials.

curl -X POST https://auth.promptessor.com/register \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "Example integration",
    "redirect_uris": ["https://example.com/oauth/promptessor/callback"],
    "grant_types": ["authorization_code", "refresh_token"],
    "response_types": ["code"],
    "token_endpoint_auth_method": "none",
    "scope": "usage:read history:read"
  }'