Token management (user JWT)
All endpoints in this section require a user JWT. Agent tokens cannot be used here.
Base path: /api/agent-tokens
GET /api/agent-tokens/me
Check whether the current user has an active agent token. Returns the token prefix only; the full token is never returned.
Request
| Where | Name | Type | Required | Description |
|---|
| Header | Authorization | string | Yes | Bearer <user JWT> |
Response (200)
| Field | Type | Description |
|---|
has_token | boolean | Whether the user has an agent token. |
token_prefix | string | null | If has_token is true, first visible part (e.g. sk_agt_1a2b3c4d...). Null when no token. |
Example
{ "has_token": true, "token_prefix": "sk_agt_1a2b3c4d..." }
curl -X GET "https://api.jobhuntr.com/api/agent-tokens/me" \
-H "Authorization: Bearer <user_jwt>"
Error responses
| Status | Cause |
|---|
| 401 | Missing or invalid JWT. |
| 500 | Failed to fetch token status. |
POST /api/agent-tokens/me
Generate or rotate the agent API token. If a token already exists, it is replaced. The raw token is returned once; store it securely.
Request
| Where | Name | Type | Required | Description |
|---|
| Header | Authorization | string | Yes | Bearer <user JWT> |
No body.
Response (200)
| Field | Type | Description |
|---|
token | string | Full agent token (e.g. sk_agt_<64 hex>). Shown only on this response. |
token_prefix | string | Prefix for display (e.g. sk_agt_1a2b3c4d...). |
message | string | Human-readable message (e.g. "Store this token securely — it will not be shown again."). |
Example
{
"token": "sk_agt_a1b2c3d4e5f6...",
"token_prefix": "sk_agt_a1b2c3d4...",
"message": "Store this token securely — it will not be shown again."
}
curl -X POST "https://api.jobhuntr.com/api/agent-tokens/me" \
-H "Authorization: Bearer <user_jwt>"
Error responses
| Status | Cause |
|---|
| 401 | Missing or invalid JWT. |
| 500 | Failed to store agent token. |
POST /api/agent-tokens/me/get-or-create
Return the existing agent token prefix, or create a new token if none exists. Idempotent for "obtain token in one call" flows.
Request
| Where | Name | Type | Required | Description |
|---|
| Header | Authorization | string | Yes | Bearer <user JWT> |
No body.
Response (200)
| Field | Type | Description |
|---|
is_new | boolean | true if a new token was created; false if one already existed. |
token | string | null | Full agent token only when is_new is true. Otherwise null. |
token_prefix | string | Display prefix in all cases. |
message | string | Human-readable message. |
Example (new token)
{
"is_new": true,
"token": "sk_agt_...",
"token_prefix": "sk_agt_1a2b3c4d...",
"message": "Token created. Store it securely — it will not be shown again."
}
Example (existing token)
{
"is_new": false,
"token": null,
"token_prefix": "sk_agt_1a2b3c4d...",
"message": "Token already exists. Rotate it from Settings if you need a new one."
}
curl -X POST "https://api.jobhuntr.com/api/agent-tokens/me/get-or-create" \
-H "Authorization: Bearer <user_jwt>"
Error responses
| Status | Cause |
|---|
| 401 | Missing or invalid JWT. |
| 500 | Failed to check or store token. |
DELETE /api/agent-tokens/me
Revoke the current user's agent token. All agents using it lose access immediately.
Request
| Where | Name | Type | Required | Description |
|---|
| Header | Authorization | string | Yes | Bearer <user JWT> |
Response
curl -X DELETE "https://api.jobhuntr.com/api/agent-tokens/me" \
-H "Authorization: Bearer <user_jwt>"
Error responses
| Status | Cause |
|---|
| 401 | Missing or invalid JWT. |
| 500 | Failed to revoke token. |
Humaboam