Account access and reader access
An author account can manage its own content. A private-site reader can read the site after email verification. Reader access does not give permission to publish, change site settings, or export an account.
Key format
New permanent keys use jot_sk_ followed by 43 URL-safe Base64 characters.
The complete key is 50 characters long. Keys are case-sensitive.
The suffix comes from 32 cryptographically random bytes.
Jot returns the complete key only at creation. It stores a SHA-256 hash of the complete key. Key lists show the first 16 characters followed by an ellipsis. The displayed prefix cannot authenticate a request.
Previously issued keys remain valid until revoked. You do not need to replace them because of this format change. Permissions come from the stored record. The key text does not identify a permission level or environment.
OAuth access tokens use jot_at_. OAuth refresh tokens use jot_rt_.
These tokens have separate expiration and revocation rules.
Key permissions
Read permits note, media, and account-settings reads. Publish also permits note and media changes. Full access adds export, site settings, domains, and private-site readers.
A key acts as its account owner within its selected permissions. Create and revoke keys in the signed-in browser under Profile. A scoped key cannot create another key.
Connected applications
OAuth connects an application to the account shown on the authorization page. The application can manage notes, media, site settings, domains, and private-site readers. It can export the account. Connect only an application you trust.
- Examine the application name and account before you approve access.
- If the request is correct, select Connect application.
Remove access
- Sign in.
- Open Profile.
- Find the connected application or named key.
- Select Revoke.
Revocation stops new requests. It does not undo earlier changes. API key and connected-application security actions require browser sign-in.
Temporary note claims
Claiming a temporary note requires its original browser cookie and account sign-in. The cookie proves control of the temporary note. An API key alone does not prove control. Read Publish and control notes for claim behavior.