Accounts and tokens
You sign in to the dashboard with a code sent to your phone. Programs use API tokens instead. This page covers both, and how workspaces and teammates fit in.
Signing in
CountJar uses one-time codes instead of passwords, delivered by text message through Twilio Verify. The same steps create a new account or sign in to an existing one:
- Open Sign in, pick your country and enter your mobile number.
- Type the 6-digit code from the text message. If it doesn't arrive, you can ask for a new one after 30 seconds.
- The first time, choose your name and your first workspace's address.
You stay signed in on that browser for 30 days, or until you sign out. To protect your number, each phone number can request 5 codes an hour, and each number allows 10 code attempts an hour.
Workspaces
A workspace groups counters, tokens and teammates. Its address is part of every counter URL, so acme gives you URLs like https://countjar.vercel.app/api/v2/acme/visits. Addresses use 1 to 64 lowercase letters, digits, - or _, and they can't be changed once created.
You can own up to 3 workspaces. Your 5 counters are shared across all the workspaces you own, so you can keep 5 in one workspace or spread them out. Switch between workspaces, or create a new one, from the menu at the top of the dashboard sidebar.
Teammates
As the owner, open Members and add a teammate by their phone number. They need a CountJar account first, so ask them to sign up. Members can:
- see every counter in the workspace, change them, and create new ones (which use the owner's counter allowance);
- add milestone webhooks, and text alerts to their own phone.
Only the owner can create or revoke API tokens, add or remove members, rename the workspace or delete it. Members can leave a workspace at any time from the same page.
When someone leaves or is removed, any tokens they created are revoked and their text alerts in that workspace are deleted.
API tokens
Tokens let scripts, servers and CI use the API. The workspace owner creates them under API tokens. Give each one a name you'll recognise later and choose what it may do:
| Permission | Allows |
|---|---|
read | Read private counters, their stats and history, and raw events. |
write | Everything in read, plus every counting action: up, down, set, reset, custom step sizes, and actions on private counters. |
admin | Everything in write, plus creating, changing and deleting counters through the API. |
A token works only in the workspace it was created in. The full token, starting with cj_, is shown once when you create it. CountJar only stores a fingerprint of it, so copy it straight away. If you lose it, revoke it and create another.
Sending a token
Send the token in the Authorization header, as a Bearer token:
curl -H "Authorization: Bearer cj_your_token" \
https://countjar.vercel.app/api/v2/acme/signups/upWhere you can't set headers, such as a webhook from another service, you can pass it as a token query parameter instead:
https://countjar.vercel.app/api/v2/acme/signups/up?token=cj_your_tokenThe API never uses your dashboard sign-in. Being signed in to CountJar in the same browser gives a request no extra access, so another website can't use your session to change your counters.
When you need a token
| Request | Public counter | Private counter |
|---|---|---|
| Read the value, stats or history | No token | read |
up, like, vote, rate | No token | write |
up?by=5 (custom step) | write | write |
down, set, reset | write | write |
| Raw events | read | read |
| Create, change or delete counters | admin | admin |
Keeping tokens safe
- Keep tokens on servers, in scripts and in CI secrets. Anything sent to a browser can be read by visitors.
- For counting on a website, use a public counter and no token at all. The widgets work this way.
- Give each program its own token with the lowest permission it needs, so you can revoke one without breaking the others.
- The tokens page shows when each token was last used, which helps you spot ones you no longer need.
Your account
Change your name under Account. You can also add an email, birthday, website, company or role, and time zone there. All are optional and only you can see them; teammates see your name and phone number. With a time zone set, the dashboard shows when your daily count resets in your own time.
Deleting your account also deletes every workspace you own, with all their counters, history and tokens, and removes you from workspaces you were added to. It can't be undone.