Authentication

Pulse supports two authentication methods: session-based auth for the web app and API key auth for programmatic access.

Session Authentication

The web app uses Auth.js v5 with two passwordless providers:

• Google OAuth — Sign in with your Google account
• Email (Resend) — Receive a magic link via email

No passwords are stored. Sessions are managed via database-backed session tokens.

API Key Authentication

For programmatic access (MCP server, scripts, integrations), use API keys.

Creating an API Key

1. Go to Settings → API Keys in the Pulse web app
2. Click Generate Key
3. Copy the key immediately — it won't be shown again

API keys have the prefix pgtd_ followed by a random string.

Using an API Key

Include the key as a Bearer token in the Authorization header:

Authorization: Bearer pgtd_your_api_key_here

Example Request

curl https://pulsegtd.app/api/v1/tasks \
  -H "Authorization: Bearer pgtd_abc123def456" \
  -H "Content-Type: application/json"

Key Management

Keys are stored as SHA-256 hashes — Pulse never stores the raw key. The keyPrefix (first 8 characters) is stored for identification.

Error Responses

Unauthenticated requests receive a 401 Unauthorized response:

{
  "error": "Unauthorized"
}

Security Notes

• API keys grant full access to your account — treat them like passwords
• Rotate keys regularly via the Settings page
• Keys can be revoked instantly if compromised
• The lastUsedAt field tracks when each key was last used