API Authentication

The IntuitivePM REST API supports two authentication methods: JWT tokens obtained via login, and API keys generated from your account settings. All API requests must include a valid credential in the Authorization header.

Base URL

All API endpoints use the following base URL:

https://api.intuitivepm.net/api

Method 1: JWT Token

Obtain a JSON Web Token by sending your email and password to the login endpoint. Tokens are valid for 24 hours.

Request

curl -X POST https://api.intuitivepm.net/api/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "you@example.com",
    "password": "your-password"
  }'

Response

{
  "user": {
    "id": "cmiawfzpf0000mzcelcgcfwh0",
    "email": "you@example.com",
    "name": "Your Name",
    "role": "ADMIN"
  },
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Use the returned token value in subsequent requests:

curl -X GET https://api.intuitivepm.net/api/projects \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Token Refresh

Tokens expire after 24 hours. When a token expires, the API returns a 401 Unauthorized response. To continue, request a new token by logging in again. There is no separate refresh endpoint — re-authenticate with your credentials to obtain a fresh token.

Method 2: API Key

For long-lived integrations and scripts, use an API key instead of a JWT token. API keys do not expire unless you revoke them.

Generating an API Key

1. Log in to IntuitivePM at intuitivepm.net.
2. Navigate to Settings > API.
3. Click Generate API Key.
4. Copy the key immediately — it is only displayed once.

Using an API Key

Include your API key in the Authorization header with the Bearer prefix, the same way you would use a JWT token:

curl -X GET https://api.intuitivepm.net/api/projects \
  -H "Authorization: Bearer your-api-key-here"

Code Examples

Python

import requests

API_BASE = "https://api.intuitivepm.net/api"

# Authenticate with email and password
response = requests.post(
    API_BASE + "/login",
    json={"email": "you@example.com", "password": "your-password"}
)
token = response.json()["token"]

# Use the token for subsequent requests
headers = {"Authorization": "Bearer " + token}
projects = requests.get(API_BASE + "/projects", headers=headers)
print(projects.json())

JavaScript

const API_BASE = "https://api.intuitivepm.net/api";

// Authenticate with email and password
const authResponse = await fetch(API_BASE + "/login", {
  method: "POST",
  headers: {"Content-Type": "application/json"},
  body: JSON.stringify({
    email: "you@example.com",
    password: "your-password"
  })
});
const data = await authResponse.json();
const token = data.token;

// Use the token for subsequent requests
const projects = await fetch(API_BASE + "/projects", {
  headers: {"Authorization": "Bearer " + token}
});
console.log(await projects.json());

Rate Limits

The API enforces rate limits based on your authentication method:

When you exceed the rate limit, the API returns a 429 Too Many Requests response with a Retry-After header indicating how many seconds to wait before retrying.

Security Best Practices

• Never expose credentials in client-side code. API keys and tokens should only be used in server-side applications or secure environments.
• Store tokens securely. Use environment variables or a secrets manager — never hardcode tokens in source code.
• Use API keys for automation. JWT tokens are better suited for interactive sessions; API keys are better for scripts, CI/CD pipelines, and integrations.
• Rotate API keys periodically. Revoke old keys in Settings and generate new ones on a regular schedule.
• Use HTTPS exclusively. All API requests must use HTTPS. HTTP requests are rejected.

Next Steps

With authentication configured, explore the full API Endpoints reference to start working with projects, tasks, colleagues, and webhooks.