Authentication

Every request carries an API key as a bearer token:

http

Authorization: Bearer kosuke_<64 hex characters>

Keys are minted in the web app under Settings, API keys, which calls POST /api/user/api-keys from your browser session. The full key is returned once, at creation. Kosuke stores only its hash. A key can be given an expiry or left to live forever, and revoking one takes effect on the next request, because keys are looked up by hash every time.

A key is a user-level credential, like a GitHub personal access token. It identifies its user and carries their full authority. It belongs to no workspace, so a keyed request has no active workspace. Two consequences matter:

• Endpoints that list your work span every workspace you belong to, rather than one selected workspace.
• Endpoints that create something inside a workspace need you to name it. POST /api/projects takes an orgId for exactly this reason, and your membership of it is checked.

Start here

Start by calling GET /api/organizations to learn which workspaces the key can act in.