Authentication

Jonga OCR has two distinct authentication paths. Humans sign in to the dashboard at /sign-in using Google or email/password (handled by Clerk) to manage their API tokens. Machines (your backend, mobile app, or scripts) call the OCR endpoints with a Bearer token created from that dashboard. All /api/v1/ocr/* endpoints require a valid API token passed in the Authorization header.

Token Format

jonga_aBcDeFgHiJkLmNoPqRsTuVwXyZ012345

Creating a Token

Tokens are created from the dashboard, not via a public API endpoint. Sign in at /sign-in, then go to /dashboard/tokens and click Create Token. Give it a project name, choose scopes, and (optionally) set an expiry. The plaintext token is shown only once on the confirmation modal — copy it immediately, because the server stores only a SHA-256 hash and the value cannot be retrieved again.

Using a Token

Include your token in the Authorization header on every API request using the Bearer scheme.

curl -X POST https://your-domain.vercel.app/api/v1/ocr/sa-id-smart-front \
  -H "Authorization: Bearer jonga_YOUR_TOKEN" \
  -F "image=@./id-front.jpg"

Scopes

Tokens can be restricted to specific document types using scopes. A token will be denied access to any endpoint not covered by its scopes.

When creating a token from /dashboard/tokens, select only the scopes you need. For example, an ID verification flow that only reads SA Smart IDs should be limited to sa-id-smart-front and sa-id-smart-back — not *.

Token Info

Retrieve metadata about your token using the GET /api/v1/tokens/me endpoint. This is useful for checking scopes, expiry, and usage statistics.

curl https://your-domain.vercel.app/api/v1/tokens/me \
  -H "Authorization: Bearer jonga_YOUR_TOKEN"

{
  "success": true,
  "tokenPrefix": "jonga_aBcD",
  "projectName": "My App",
  "scopes": ["*"],
  "isActive": true,
  "expiresAt": "2027-01-01T00:00:00Z",
  "createdAt": "2026-04-05T10:00:00Z",
  "lastUsedAt": "2026-04-05T14:32:00Z",
  "requestCount": 142
}

Security Best Practices