Authentication

Every data query requires an app key in the X-App-Key request header. Introspection and GET /health work without one.

curl -s https://launch-dev.jetstream.studio/graphql \
  -H 'content-type: application/json' \
  -H 'X-App-Key: prk_your_key_here' \
  -d '{"query":"{ property(id:\"<your-property-id>\"){ name } }"}'

The app key

• is a public-by-design client identifier not a secret. It ships inside your app binary or browser bundle and is expected to be extractable. It identifies your application (for attribution, rate limiting, and revocation) - it is not a security boundary.
• is one key per application (your mobile, TV, and web builds each get their own). Revoking one never breaks the others.
• is scoped to a property. A query for any other property id returns NOT_FOUND, identical to a nonexistent id, so it never reveals whether another property exists.

Getting a key

App keys are issued by the Hope.Cloud team per application. You receive a prk_… value to embed in your build.

Missing or invalid key

A data query without a valid key fails with a UNAUTHORIZED error and no data:

{
  "errors": [
    { "message": "Missing X-App-Key header", "path": ["property"], "extensions": { "code": "UNAUTHORIZED" } }
  ],
  "data": null
}