Authentication
Authenticate Public API requests with an organization API key.
Use the Authorization header with the Bearer scheme:
Authorization: Bearer klu_live_replace_meThe Public API does not accept dashboard JWTs, cookies, CSRF tokens, or API keys in the query string.
Key ownership
Each key belongs to one organization. The organization is resolved from the key, so public requests never need an organizationId parameter.
Who can create or rotate keys
- Admins approve or disable Public API access for an organization.
- Organization owners generate the first key after approval.
- Organization owners rotate an active key if it is lost or exposed.
- The full key is shown only once after generate or rotate.
Where to store the key
Store the key in a server-side secret manager, private environment variable, or secure agent runtime.
Do not store the key in:
- Browser JavaScript
- Mobile app bundles
- Public Git repositories
- Public AI prompts
- Screenshots, logs, support tickets, or analytics tools
First authenticated request
curl https://api.klupos.com/public-api/v1/me \
-H "Authorization: Bearer klu_live_replace_me"If the key is valid and active, the response contains key metadata and organization metadata. It never returns the raw key.
Invalid or revoked keys
Missing, invalid, revoked, or disabled keys return 401.
{
"code": 401,
"message": "Invalid API key"
}Treat 401 as a reason to check whether the key was copied correctly, rotated, revoked, or disabled by support.