Project token authentication for CI uploads

The client endpoints authenticate with a single header: Project-Token. There is no per-user API key, no bearer token, and no OAuth flow on the ingestion path, and every request is scoped to exactly one project.

The Project-Token header

The three client endpoints (upload, finalize, upload_failed) all use the same header:

Project-Token: <your project token>

If the header is missing or does not match a project, the request is rejected with 404 Not Found rather than 401 Unauthorized, so a wrong token cannot be told apart from a project that does not exist.

Finding your project token

1. Sign in to TestNod and open the project you want to upload to.
2. Click Project Settings in the project header.
3. The token appears in the Project Token section, in the field labeled Secret token.

Every member of the project's organization can open this page and copy the token. Changing other project settings is restricted to admins, but the token itself stays visible to all members.

Storing the token in CI

Treat the token like any production secret:

• Add it as a CI secret under a name like TESTNOD_PROJECT_TOKEN. The provider pages in CI integrations show the exact UI.
• Reference the secret from your pipeline config rather than hard-coding the value.
• Do not commit the token to your repository, even in a private one. Build logs leak more often than people think.
• Use a separate token per project. There is no concept of an "organization token" today.

Rotating a token

If a token leaks, or you want to cycle it as part of regular maintenance, an organization admin can regenerate it from the project's settings page. Members who aren't admins can still read the token, but only admins see the regenerate button.

1. Sign in to TestNod and open the project.
2. Click Project Settings in the project header.
3. In the Project Token section, click Regenerate token.
4. Confirm in the dialog that appears.

The new token takes effect immediately and the old one stops working, so any CI job still sending the old value will get a 404 Not Found on its next upload. Update your CI secret as soon as possible before running the next job to avoid disruptions. Uploads already in flight when you regenerate are unaffected once TestNod has accepted them.

What an invalid token looks like

HTTP/1.1 404 Not Found
Content-Type: application/json

{"error_message":"Project not found."}

If you see this from CI but the same curl works from your laptop, the most common cause is the secret name not matching what the pipeline expects, or the secret not being available to the job (for example, GitHub Actions does not expose secrets to forks by default).