Registry Authentication

Jolocky provides community open-source sections under the MIT license and exclusive award-winning blocks for Pro members. To protect creator intellectual property while maintaining a frictionless developer experience, Jolocky uses token-based registry authentication.

How Authentication Works#

When you install a Pro section, the registry CLI sends an HTTP GET request to https://jolocky.com/r/[slug].json.

For Pro sections, the endpoint expects a bearer token containing your license key:

CopyGET /r/golden-hour.json HTTP/1.1
Host: jolocky.com
Authorization: Bearer JOLOCKY-PRO-XXXX-XXXX

The authentication pipeline executes the following checks:

1. Format Validation: Checks that the key matches the standard Jolocky license format.
2. Database Verification: Queries the PostgreSQL database to verify that the license exists, is marked active, and has not passed its 365-day expiration date.
3. Rate Limiting: Enforces abuse protection via Redis, allowing up to 120 requests per minute for authenticated Pro members while throttling suspicious scrapers.
4. Access Logging: Records the section access event in cli_logs for your review in your Member Dashboard.

Passing Your Token#

There are three ways to authenticate the CLI:

1. Command Line Flag#

Pass the --token flag directly when running the command:

pnpmnpmyarnbun
pnpm dlx shadcn@latest add https://jolocky.com/r/golden-hour --token JOLOCKY-PRO-XXXX-XXXX
Copy

2. Environment Variable#

Export SHADCN_TOKEN in your terminal shell or .bashrc / .zshrc:

Copyexport SHADCN_TOKEN="JOLOCKY-PRO-XXXX-XXXX"
npx shadcn@latest add https://jolocky.com/r/golden-hour

3. Namespace Configuration in components.json#

Embed the environment variable in your components.json:

Copy{
  "registries": {
    "@jolocky": {
      "url": "https://jolocky.com/r/{name}.json",
      "headers": {
        "Authorization": "Bearer ${JOLOCKY_LICENSE_KEY}"
      }
    }
  }
}

Managing Your License#

You can check your remaining subscription days, reveal your license key, or revoke a compromised token at any time inside the Member Dashboard.