Authentication

The Management API uses scoped keys created in Koneth Console. Send the complete one-time key in the Authorization header with the Management scheme.

Authorization: Management kapi.<key-id>.<secret>

Key format

A management key has three dot-separated parts:

kapi.<UUID key ID>.<64-character secret>

Koneth stores a hash of the secret. The Console displays the full key only when you create it.

Create a key

In Koneth Console, open API Keys for your organization and configure:

• A descriptive name for the integration.
• The minimum scopes it needs.

Keys created by the current Console form apply to every server in the organization and do not have an expiry setting. The Management API enforces any server restriction or expiry already stored on a key, but those two controls are not available in the current Console form.

Tip

Create separate keys for production, staging, and each external integration. This limits the impact of a leaked or revoked key.

Send the header

curl --request GET \
  --url https://api.koneth.com/api/v1/management/credits/balance \
  --header "Authorization: Management $KONETH_API_KEY"

The scheme is Management, not Bearer.

Replace or revoke a key

To replace a key in the current Console, create a new key, update and verify your integration, then revoke the old key.

Revoke a key immediately if it is exposed or no longer needed. Requests with expired, revoked, or malformed keys return 401.

Security requirements

• Store keys in a server-side secret manager.
• Never embed keys in browser JavaScript, desktop bundles, or mobile applications.
• Never log the Authorization header.
• Use one key per integration.
• Grant only the scopes and server access the integration requires.
• Revoke temporary keys as soon as the integration no longer needs them.