Registry Authentication

Free items are released under the MIT License and need no key. Pro items are available to Pro Annual subscribers, and the registry only returns their source when the request includes a valid license key.

How Authentication Works#

When you install a Pro item, the shadcn CLI sends a GET request to https://www.jolocky.com/r/<item>.json. The registry accepts the license key in any of these forms:

• Query parameter: ?key=YOUR_LICENSE_KEY (?token= and ?license= also work)
• Header: x-jolocky-license: YOUR_LICENSE_KEY
• Header: Authorization: Bearer YOUR_LICENSE_KEY

CopyGET /r/golden-hour.json HTTP/1.1
Host: www.jolocky.com
Authorization: Bearer YOUR_LICENSE_KEY

The registry checks that the key belongs to an active, unexpired Pro license. If the key is missing, invalid, or expired, it responds with 403 and returns no source code. Registry requests are also rate limited.

Always use https://www.jolocky.com with www. The apex domain jolocky.com redirects to www, and Node's fetch drops the Authorization header on that cross-origin redirect, so Bearer authentication sent to the apex domain fails.

Passing Your Key with the shadcn CLI#

The shadcn CLI has no command-line flag for license keys. Use one of these two methods.

1. Key in the URL#

pnpmnpmyarnbun
pnpm dlx shadcn@latest add "https://www.jolocky.com/r/golden-hour.json?key=YOUR_LICENSE_KEY"
Copy

Quote the URL so your shell does not interpret the ?. The key is saved in your shell history.

2. Namespace in components.json#

Add the registry with an Authorization header that reads an environment variable:

Copy{
  "registries": {
    "@jolocky": {
      "url": "https://www.jolocky.com/r/{name}.json",
      "headers": {
        "Authorization": "Bearer ${JOLOCKY_LICENSE_KEY}"
      }
    }
  }
}

Set the variable in .env.local (or .env):

CopyJOLOCKY_LICENSE_KEY="YOUR_LICENSE_KEY"

Then install by name:

pnpmnpmyarnbun
pnpm dlx shadcn@latest add @jolocky/golden-hour
Copy

The CLI expands ${JOLOCKY_LICENSE_KEY} from the environment. If it is not set, the CLI stops with an error asking you to set it in .env or .env.local. This method keeps the key out of components.json and your shell history.

Finding Your Key#

Your key is on the License tab of the member dashboard. From there you can reveal and copy the key, or copy it as a JOLOCKY_LICENSE_KEY="..." line for .env.local. Each item page shows its install command, and bookmarked items in the dashboard's Bookmarks tab show theirs too.

Keeping Your Key Safe#

• Do not commit .env.local or .env files that contain your key.
• One license is for one developer. See the License for the terms.
• If your key is exposed, email support@jolocky.com.