API Authentication & Tokens

API Authentication & Tokens

The Kinexa API uses bearer tokens for authentication.

Generating an API Key

1. Go to Settings → Developer → API Keys
2. Click Create Key, name it (e.g. "Website integration")
3. Copy the key immediately — it's shown only once

Making Authenticated Requests

Send the key in the Authorization header:

curl https://api.kinexa.id/v1/contacts \
  -H "Authorization: Bearer kx_live_xxxxx"

Key Scopes

Limit each key to only the access it needs:

• read — fetch data only
• write — create and update
• Module scopes such as mitra, atlas, liqaa

Security Best Practices

• Never commit keys to Git or expose them in front-end code
• Store keys in environment variables
• Rotate keys periodically and revoke unused ones
• Use a separate key per integration so you can revoke one without breaking others

Revoking a Key

Click Revoke next to any key. Requests using it fail immediately with 401 Unauthorized.