Jinba · Authentication Profile

Jinba Authentication

Authentication

Jinba authenticates programmatic access with Bearer API keys. Jinba Toolbox supports two methods: session-based auth (Better Auth session cookies) for the admin web console, and organization-scoped API keys (jtb_ prefix) passed as a Bearer token for the SDK, AI agents, and external integrations. Jinba Flow's External API uses a per-flow Bearer API key that is auto-generated when a workflow is published. There is no OAuth2 authorization flow and no documented scope surface; access is governed by organization-level RBAC (Owner/Admin/ Member) and PostgreSQL row-level security tenant isolation.

Jinba secures its APIs with http across 3 declared security schemes, as derived from its OpenAPI definitions.

CompanyArtificial IntelligenceAgentsWorkflow-AutomationEnterpriseMCPLow-CodeDeveloper ToolsToolsAutomation
Methods: http Schemes: 3 OAuth flows: API key in:

Security Schemes

toolbox-api-key http
scheme: bearer
toolbox-session session
flow-api-key http
scheme: bearer

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-19'
method: searched
source: >-
  https://docs.jinba.io/en/pages/toolbox/advanced/security and
  https://docs.jinba.io/en/pages/toolbox/developer/api and
  https://docs.jinba.io/en/pages/basics/api
docs: https://docs.jinba.io/en/pages/toolbox/advanced/security
summary:
  types:
  - http
  http_schemes:
  - bearer
  api_key_prefix: jtb_
  oauth2_flows: []
description: >-
  Jinba authenticates programmatic access with Bearer API keys. Jinba Toolbox
  supports two methods: session-based auth (Better Auth session cookies) for the
  admin web console, and organization-scoped API keys (jtb_ prefix) passed as a
  Bearer token for the SDK, AI agents, and external integrations. Jinba Flow's
  External API uses a per-flow Bearer API key that is auto-generated when a
  workflow is published. There is no OAuth2 authorization flow and no documented
  scope surface; access is governed by organization-level RBAC (Owner/Admin/
  Member) and PostgreSQL row-level security tenant isolation.
schemes:
- name: toolbox-api-key
  type: http
  scheme: bearer
  key_prefix: jtb_
  scope: organization
  header: 'Authorization: Bearer [example key]'
  expiration: none by default (valid until manually deleted)
  notes: >-
    Keys are scoped to a single organization, track their issuer, record a
    last-used timestamp, and creation/deletion is audit-logged.
  sources:
  - openapi/jinba-toolbox-openapi.yml
  - https://docs.jinba.io/en/pages/toolbox/advanced/security
- name: toolbox-session
  type: session
  mechanism: Better Auth session cookies
  scope: web console (human users)
  sources:
  - https://docs.jinba.io/en/pages/toolbox/advanced/security
- name: flow-api-key
  type: http
  scheme: bearer
  scope: per published flow
  header: 'Authorization: Bearer [example key]'
  notes: Auto-generated on publish; regenerating invalidates the old key immediately.
  sources:
  - openapi/jinba-flow-openapi.yml
  - https://docs.jinba.io/en/pages/basics/api
rbac:
  roles: [Owner, Admin, Member, super_admin]
  isolation: organization-based; PostgreSQL Row Level Security enforces tenant isolation.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/jinba-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.