FAQ's

Authentication & Usage

Q: How do I authenticate API requests with my token?
A: Include your token in the Authorization header of your HTTP requests using the Bearer scheme:

Authorization: Bearer T_53PNqKmLCfC_fUnVQB5PpBgplOOn8zzNEaeE0tJVY

Q: Can I use the same token for multiple applications or services?
A: Technically yes, but it's not recommended. Create separate applications for each service to maintain better control, security, and the ability to revoke access independently.

Q: Do tokens expire?
A: API tokens do not have an automatic expiration date. However, you should rotate them periodically as a security best practice or immediately if you suspect a token has been compromised.

Q: Can I test my token before implementing it in production?
A: Yes, you can make test API calls to verify your token is working correctly. Consider creating a separate "Testing" or "Development" application for this purpose.

Security

Q: What should I do if I accidentally exposed my token?
A: Immediately delete the compromised application from the API section. This will instantly invalidate the token. Then create a new application and update your integration with the new token.

Q: Where should I store my API token?
A: Store tokens securely using:

Environment variables (.env files for local development)
Secret management services (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault)
Secure configuration management tools
Never hardcode tokens in your source code or commit them to version control

Q: Can I restrict what my token can access?
A: Token permissions are tied to the admin user who created the application. The token inherits the same access rights and permissions as that user within the Jet HR workspace.

Q: Is it safe to use API tokens over HTTP?
A: No, always use HTTPS for API requests. HTTP transmits data in plain text, which could expose your token to interception.

Rate Limiting & Performance

Q: Are there rate limits on API calls?
A: Check your Jet HR plan documentation for specific rate limits. You can monitor your application's API call count in the "Chiamate" column of the applications table.

Q: What happens if I exceed the rate limit?
A: Your requests will receive HTTP 429 (Too Many Requests) responses. Implement exponential backoff retry logic in your application to handle this gracefully.

Q: How can I optimize my API usage?
A: Implement caching strategies, batch requests when possible, only request the data you need, and avoid polling—use webhooks if available.

Integration & Development

Q: Can multiple team members create API applications?
A: Yes, any admin user with appropriate permissions can create applications. However, coordinate with your team to avoid creating duplicate applications.

Q: What happens to API tokens when a user who created them leaves the company?
A: The tokens remain active even if the user account is deactivated. For security, audit and recreate critical integrations under an active admin account or a dedicated service account.

Q: Can I see which specific API endpoints my token has accessed?
A: Click on "Vedi dettagli" (View details) in the actions menu to see detailed usage statistics and request history for each application.

Q: How do I debug failed API requests?
A: Check the response status codes and error messages. Common issues include:

401 Unauthorized: Invalid or expired token
403 Forbidden: Insufficient permissions
404 Not Found: Incorrect endpoint URL
429 Too Many Requests: Rate limit exceeded
500 Internal Server Error: Server-side issue (contact support)

Management & Maintenance

Q: Should I delete old or unused applications?
A: Yes, removing unused applications reduces security risks and keeps your API management clean. Always delete applications that are no longer in use.

Q: Can I rename an existing application?
A: Currently, you cannot rename applications. If you need a different name, create a new application, migrate your integration, and delete the old one.

Q: How do I know when my token was last used?
A: The "Ultimo utilizzo" (Last used) column in the applications table shows the timestamp of the token's most recent API call.

Q: Can I temporarily disable a token without deleting it?
A: No, there's no "pause" or "disable" feature. To revoke access, you must delete the application, which permanently invalidates the token.

Getting Help

Q: Where can I find the complete API documentation?
A: Refer to the main API documentation for detailed information about available endpoints, request/response formats, and code examples.

Q: What should I do if I encounter API errors I can't resolve?
A: Contact your Jet HR administrator or support team with:

The application name and masked token (first/last few characters)
Timestamp of the issue
Error messages or status codes received
Steps to reproduce the problem