Authentication
Every request carries a secret API key in the Authorization header, as a bearer token. Keys belong to a project in your organisation, and each one is limited to what its scopes allow.
curl
curl https://api.kennmarq.com/v1/usage \
-H "Authorization: Bearer $KENNMARQ_API_KEY"Key format
A key is sk_live_ or sk_test_ followed by 43 letters and digits (256 random bits). The prefix tells you, and us, which environment it works in. The dashboard shows each key's first characters and last four, so you can tell keys apart without the secret.
Keeping keys secret
- Use keys from your servers only: never in a browser, a mobile app or a public repository.
- We store a SHA-256 of each key and show the key once, when it's created. We can't show it again.
- To rotate, create the new key, deploy it, then revoke the old one in the dashboard. A revoked key stops working at once.
- Limit live keys to your servers' addresses with an IP allowlist.
- Every key created, changed or revoked is recorded in your organisation's audit log.
Keys in URLs
Only one endpoint takes its key in the URL: POST /v1/tsa/{key}, because the C2PA library that calls it can't send headers. A URL ends up in logs, so that endpoint accepts only keys whose single scope is tsa, and refuses any other key with 403 key_not_allowed_in_url. If that happens, rotate the key you sent.
Authentication errors
| Status | Code | Meaning |
|---|---|---|
| 401 | missing_api_key | No Authorization: Bearer … header. |
| 401 | invalid_api_key | The key isn't one of ours, or is malformed. |
| 401 | api_key_revoked | The key was revoked, or its project deleted. |
| 403 | insufficient_scope | The key lacks the scope this endpoint needs. |
| 403 | ip_not_allowed | The request came from an address outside the key's IP allowlist. |
| 403 | key_not_allowed_in_url | A key with scopes beyond tsa was sent in a URL. |