Skip to main content
API keys provide machine-to-machine authentication for the KaireonAI platform. Keys use the krn_ prefix and are hashed before storage — the raw key is only shown once at creation time.

The two API planes

The platform API is split into two planes:

Key scopes

Every API key carries a scopes field — a JSON array of permission strings set at creation time and never changed afterwards.
Migration note: as of the control-plane / data-plane split, existing API keys with no explicit scopes are now data-plane-only (recommend/respond). To manage resources programmatically, mint a new key with the control-plane scope.
A key without the required access gets an HTTP 403 with this body:
Scopes are validated at creation via Zod: each entry is a string of 1–64 characters; maximum 16 entries per key. There is no update route — scope assignment is create-time only. The in-process auth cache refreshes every 15 seconds, so a revoked or newly created key takes up to 15 seconds to propagate.

Defined scopes

Keep control-plane keys internal — treat them like server credentials. Never embed one in a client app, mobile app, or browser code. Ship data-plane-only keys (the default) to anything customer-facing.
The master/internal server key (API_KEY env var) and cron/webhook secrets are internal infrastructure, not customer keys — they are unaffected by scopes.

POST /api/v1/api-keys

Generate a new API key. Admin only.

Request Body

Example — data-plane key (default)

Example — control-plane key (management access)

Example — SCIM-scoped key

Response (201)

The raw API key (key field) is only returned on creation. Store it securely — it cannot be retrieved later. Scopes are set at creation and cannot be updated; revoke and re-create the key to change them.

GET /api/v1/api-keys

List all active (non-revoked) API keys for the tenant. Returns prefixes and scopes — not the full key. Admin only.

Response


DELETE /api/v1/api-keys?id=

Revoke an API key (soft delete). The key immediately stops working. Admin only.

Query Parameters

Request Body (optional)

Response

204 No Content on success.