Authenticating with JWT vs API key

Choppity supports two auth modes for the public API. Pick the one that matches who owns the action and where the code runs.

API key (server automation)

Use Authorization: Key <secret> for backend scripts, cron jobs, Zapier, and n8n. Keys act as the team and suit batch processing without a logged-in user session present.

Firebase JWT (user context)

Use Authorization: Bearer <firebase_id_token> when acting as a specific signed-in user. Required for some user-bound endpoints and matches web app permissions for that person.

Which to choose

Automating clip pipelines in your data center: API key. Building a custom portal where each customer logs in: JWT. Never expose either secret in frontend JavaScript bundles shipped to browsers.

Security

Rotate keys periodically. JWTs expire quickly; refresh them from your auth flow. Webhooks management in the UI requires JWT session auth, not API keys alone.