Skip to main content

API Authentication

Sable API supports two authentication methods: User API Keys and Jetta SSO.

User API Keys​

For programmatic access, use API keys generated from the Sable dashboard.

Getting a Key​

  1. Go to Sable → Settings → User Settings → API Keys
  2. Click "Generate New Key"
  3. Copy the key (shown only once)

Using the Key​

Include the key in the x-api-key header:

curl -H "x-api-key: sk_a5b6aac152e01d55066c0a1807eb4f81" \
  https://sable-data.jettaintelligence.com/api/health

Key Format​

Keys follow the pattern: sk_ followed by 32 hex characters.

sk_a5b6aac152e01d55066c0a1807eb4f81

Key Rotation​

To rotate a compromised key:

  1. Generate a new key
  2. Update all clients
  3. Revoke the old key

Jetta SSO​

For browser-based access, Sable uses Jetta SSO authentication via the jetta_token cookie.

How It Works​

  1. User visits Sable
  2. Middleware checks for jetta_token cookie
  3. If missing, redirect to login.jettaintelligence.com
  4. After login, cookie is set on .jettaintelligence.com
  5. User is redirected back, now authenticated
  • Name: jetta_token
  • Domain: .jettaintelligence.com
  • HttpOnly: true
  • Secure: true

Permission Scopes​

ScopeAccess
read:pnlView P&L data
read:returnsView return calculations
write:uploadUpload files
adminFull access

Rate Limits​

EndpointLimit
/api/returns/*100 req/min
/api/storage/upload10 req/min
/api/healthUnlimited

Error Responses​

401 Unauthorized​

{
  "error": "Invalid or expired API key"
}

Fix: Check key is correct, generate new if needed.

403 Forbidden​

{
  "error": "Insufficient permissions"
}

Fix: Check user has required scope, contact admin.