# Authentication and errors

> Tokens, rate limits, errors and language for all of Jazui's APIs.

Source page: https://docs.jazui.com/api/en

All of Jazui's APIs live at `https://api.jazui.com`, use HTTPS and answer in JSON (except `/Render`, which returns HTML, and the public site files). There are four groups:

| API | What for | Token |
|---|---|---|
| [Render](https://docs.jazui.com/llms/en/api-render.txt) | Used by integrations to ask for pages. | Render (account or site) |
| [Cache](https://docs.jazui.com/llms/en/api-cache.txt) | Recache or purge pages from your deployment or CMS. | Render (account or site) |
| [Blog v2](https://docs.jazui.com/llms/en/api-blog.txt) | Read articles, categories and tags to show them on your website. | Public or render |
| [Site files](https://docs.jazui.com/llms/en/api-site-files.txt) | Sitemap, robots.txt, llms.txt, Markdown for AI and AI visits. | None |

Jazui also notifies you with [webhooks](https://docs.jazui.com/llms/en/api-webhooks.txt) when you publish an article or an alert fires.

## Tokens

Tokens go in the `Authorization` header with the `Bearer` scheme. They don't expire: they keep working until you renew or revoke them.

| Token | Where it is | Used for | Secret |
|---|---|---|---|
| **JAZUI Token** (account render) | Home › Integration and settings | Render, cache and blog, for all your sites. | Yes |
| **Site token** | Websites › Site token | Render, cache and blog, only for that site and its added subdomains. | Yes |
| **PUBLIC Token** | Home › Integration and settings | Reading the blog only. Safe to put in the browser. | No |

```bash
curl https://api.jazui.com/v2/cache/tasks \
  -H "Authorization: Bearer $JAZUI_TOKEN"
```

- When you **renew** a token from the dashboard, the old one stops working within a minute: update your integrations and deployments with the new one.
- A site token used with another domain gets a `403`.
- The PUBLIC Token doesn't work for Render or cache: it gets a `403` with no body.
- If the account is locked or deleted, its tokens stop working.

## Rate limits

| What | Limit | Counted per |
|---|---|---|
| Render, cache and blog with a token | 120 requests per minute | Account: all its tokens share the same limit |
| Feeds, site files and bot list (no token) | 120 requests per minute | IP |

Going over it returns a `429` with no body. It's a per-minute limit: wait a few seconds and try again. Integrations treat it as a failure and serve your normal website. Don't confuse this `429` with the plan limits one, which carries the `X-Jazui-Limit` header.

## Errors

| Code | When | Body |
|---|---|---|
| `400` | Invalid parameters or JSON | `{code, message}` or ProblemDetails |
| `401` | No token, or a renewed or revoked token | Empty, with `WWW-Authenticate: Bearer` |
| `403` | The token doesn't work for that API or site, unverified site, feature not in your plan, or a block | Empty or `{code, message}` |
| `404` | Doesn't exist or isn't published | `{code, message}` or empty |
| `429` | Rate, task or plan limit | Empty or `{code, message}` |
| `5xx` | Jazui error or your website failing to render | ProblemDetails or text, with `Retry-After` when retrying makes sense |

The cache and blog APIs explain the error with a stable code you can use in your code and a readable message:

`Cache or blog API error`:

```json
{ "code": "plan", "message": "Tu plan no incluye la API de caché." }
```

`ProblemDetails`:

```json
{
  "type": "https://tools.ietf.org/html/rfc9110#section-15.5.1",
  "title": "One or more validation errors occurred.",
  "status": 400,
  "errors": { "$": ["The JSON value could not be converted."] },
  "traceId": "00-6f3c…-01"
}
```

## Message language

Error messages and texts returned by the API are in Spanish by default. To get them in English, send `Accept-Language: en` or add `?culture=en` to the address. Codes (`code`) don't change with the language.

## Without a token

Some addresses are public: the bot list used by integrations, the service status, blog feeds and each verified site's files.

```bash
# Lista de bots que usan las integraciones (JSON y texto)
curl https://api.jazui.com/v2/bots
curl https://api.jazui.com/v2/bots.txt

# Bloques listos para nginx, IIS y Apache
curl https://api.jazui.com/v2/bots/config

# Estado del servicio
curl https://api.jazui.com/health
```