Authentication
Create an API key, send it in the x-api-key header, and understand what it can access.
Create a key
In the Studio open Organization → API keys and choose Create key. Give it a descriptive name such as Production feed, pick its workspace and set its access per resource.
Copy it once
The full key starts with sk- and is shown a single time. Only the prefix is shown afterwards.
Send it on every request
curl "https://app.kalpana.one/api/workspaces" \
--header "x-api-key: $KALPANA_API_KEY"Call the API from a trusted server. Never embed a key in browser code, mobile apps, shared spreadsheets, or public repositories.
What a key can access
A key belongs to one workspace and has its own access to each resource: None, Read or Write. Each endpoint page lists the permission it needs (for example templates:read or renders:create). A key never has more access than the role of the account that created it. See API Keys to set a key's access.
A request without a key, or with an unknown or revoked one, fails with 401. A request outside the key's limits fails with 403. The message says why: This API key does not have access to this workspace, or This API key lacks permission: renders:create.
Keys created before scoped access are labelled Unrestricted (legacy key). They no longer work: every request with one fails with 403 until you edit the key and give it a workspace and its access, or replace it with a new key.
A key works only with the endpoints in this reference. Account actions, such as managing API keys, sessions or billing, need a signed-in Studio session and refuse a key with 403.
Rate limit
Each key is limited to 100 requests per minute. The count starts at a key's first request and resets one minute later. Beyond that the API returns 429 with the message API key rate limit exceeded. See Errors for retry guidance.
Rotate or revoke
Create a replacement key, update your service, verify a request, then revoke the old key from Organization → API keys. Deleting a key revokes it immediately.
OAuth bearer tokens are used only by the MCP gateway. They are not an alternative way to call the endpoints in this reference.
Updated 4 Nov 2026