Authentication

# 1. User logs in
POST https://www.proign.com/api/auth/login
Content-Type: application/json

{
  "email": "user@example.com",
  "password": "your-password"
}

# Response sets cookie automatically
Set-Cookie: proign_token=<jwt>; Domain=.proign.com; HttpOnly; Secure; SameSite=Lax

# 2. Subsequent requests include cookie automatically
GET https://app.proign.com/canik/fulfillment/api/orders
Cookie: proign_token=<jwt>

{
  "sub": "user_id_here",
  "email": "user@example.com",
  "name": "John Doe",
  "tenants": [
    {
      "id": "tenant_id",
      "slug": "canik",
      "name": "Canik USA",
      "role": "admin",
      "modules": ["fulfillment", "rewards", "support", "helpdesk"],
      "userModules": ["fulfillment", "rewards"]
    }
  ],
  "iat": 1704067200,
  "exp": 1704153600,
  "iss": "proign.com",
  "aud": "proign-platform"
}

# Include the API key in the X-API-Key header
curl -X GET "https://app.proign.com/canik/fulfillment/api/orders" \
  -H "X-API-Key: pk_live_abc123..." \
  -H "Content-Type: application/json"

# Or use Bearer token format
curl -X GET "https://app.proign.com/canik/fulfillment/api/orders" \
  -H "Authorization: Bearer pk_live_abc123..." \
  -H "Content-Type: application/json"

# Create support ticket (public)
POST https://www.proign.com/api/tenants/canik/support/public/tickets
Content-Type: application/json

{
  "email": "customer@example.com",
  "name": "John Customer",
  "subject": "Product inquiry",
  "description": "I have a question about...",
  "turnstile_token": "<cloudflare-turnstile-token>"
}

# Response includes access token for tracking
{
  "ticket_number": "TKT-2024-001234",
  "access_token": "guest_abc123...",
  "message": "Your support ticket has been created."
}

// JWT payload shows both:
{
  "tenants": [{
    "slug": "canik",
    "modules": ["fulfillment", "rewards", "support"],  // Tenant has these
    "userModules": ["fulfillment"]                      // User can access these
  }]
}

// User can only access: fulfillment (intersection of both lists)

HTTP/1.1 200 OK
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 987
X-RateLimit-Reset: 1704067260

# When rate limited:
HTTP/1.1 429 Too Many Requests
Retry-After: 45
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1704067260

{
  "error": "Rate limit exceeded. Please try again later.",
  "retryAfter": 45
}

# List orders with API key
curl -X GET "https://app.proign.com/canik/fulfillment/api/orders?status=pending" \
  -H "X-API-Key: pk_live_your_key_here" \
  -H "Content-Type: application/json"

# Create support ticket
curl -X POST "https://www.proign.com/api/tenants/canik/support/public/tickets" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "customer@example.com",
    "name": "Customer Name",
    "subject": "Help needed",
    "description": "Details here..."
  }'

// Server-side with API key and rate limit handling
async function fetchWithRateLimit(url: string) {
  const response = await fetch(url, {
    headers: {
      'X-API-Key': process.env.PROIGN_API_KEY!,
      'Content-Type': 'application/json',
    },
  });

  // Log rate limit status
  const remaining = response.headers.get('X-RateLimit-Remaining');
  const limit = response.headers.get('X-RateLimit-Limit');
  console.log(`Rate limit: ${remaining}/${limit} remaining`);

  // Handle rate limiting
  if (response.status === 429) {
    const retryAfter = parseInt(response.headers.get('Retry-After') || '60');
    console.log(`Rate limited. Retrying in ${retryAfter}s...`);
    await new Promise(r => setTimeout(r, retryAfter * 1000));
    return fetchWithRateLimit(url); // Retry
  }

  return response.json();
}

const { data, meta } = await fetchWithRateLimit(
  'https://app.proign.com/canik/fulfillment/api/orders'
);

// Browser with cookies (automatic)
const response = await fetch('/api/canik/orders', {
  credentials: 'include',
});

import requests
import os
import time

def fetch_with_rate_limit(url: str, max_retries: int = 3):
    """Fetch with automatic rate limit handling."""
    for attempt in range(max_retries):
        response = requests.get(
            url,
            headers={
                'X-API-Key': os.environ['PROIGN_API_KEY'],
                'Content-Type': 'application/json',
            }
        )

        # Log rate limit status
        remaining = response.headers.get('X-RateLimit-Remaining', 'N/A')
        limit = response.headers.get('X-RateLimit-Limit', 'N/A')
        print(f"Rate limit: {remaining}/{limit} remaining")

        if response.status_code == 429:
            retry_after = int(response.headers.get('Retry-After', 60))
            print(f"Rate limited. Waiting {retry_after}s...")
            time.sleep(retry_after)
            continue

        response.raise_for_status()
        return response.json()

    raise Exception("Max retries exceeded")

data = fetch_with_rate_limit('https://app.proign.com/canik/fulfillment/api/orders')