Getting Started
Authentication
Plurence uses project-scoped API keys for gateway requests and short-lived JWTs for the management API.
API keys (gateway)
Every request to the Plurence gateway must carry a project API key. Keys are scoped to a single project — they can only route requests billed to that project's quota.
Pass the key in either the x-api-key header or as an
Authorization: Bearer token:
# Option A — dedicated header (preferred)
x-api-key: plr_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx
# Option B — Bearer token
Authorization: Bearer plr_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx API keys are shown only once at creation time. Store them in a secrets manager (e.g. AWS Secrets Manager, Vault, Doppler) — never commit them to source control.
Key rotation
You can create multiple API keys per project. To rotate:
- Create a new key in the Projects panel.
- Deploy the new key to your services.
- Verify traffic is flowing, then delete the old key.
Deleting a key is immediate — any in-flight requests using it will receive a 401 UNAUTHORIZED.
JWT tokens (management API)
The Plurence management API (data.plurence.com) is used by the dashboard
and can be called directly. It uses short-lived JWT bearer tokens obtained by signing in.
curl https://data.plurence.com/v1/signins \
-H "Content-Type: application/json" \
-d '{
"grant_type": "password",
"email": "you@example.com",
"password": "your-password"
}'
The response includes an access_token (JWT, 1-hour TTL)
and an expires_in value.
Pass it on subsequent requests:
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... Refresh tokens
JWTs can be refreshed before expiry. The dashboard does this automatically; for direct API use:
curl https://data.plurence.com/v1/signins \
-H "Authorization: Bearer CURRENT_TOKEN" \
-H "Content-Type: application/json" \
-d '{"grant_type": "refresh"}'