Getting started

Authentication

Every request carries your API key as a bearer token.

The secret is prefixed kp_live_ — or kp_test_ for a test key (see Test mode) — store it like a password. It is shown at creation, and the dashboard can show it again after an emailed verification code, so a lost secret is no reason to rotate a key an integration is running on. A request with a missing or unrecognized key answers 401 with the hint expected: Bearer kp_live_... or kp_test_....

Authorization: Bearer kp_live_...
Authorization: Bearer kp_test_...

A revoked key stops working immediately. Rotating a key mints a new secret and kills the old one at once.

Never put kp_live_ in frontend code or a public repository. Call the API only from your own server. A kp_test_ key moves no money, but treat it the same way — it is still a secret.