Authentication

One API key per customer, sent as a header on every request. No tokens to refresh.

API key

Every account has one or more API keys (subscription keys). They are sent in the ocp-apim-subscription-key header of each request. Unlike session-token schemes, the key does not expire and never needs refreshing: you revoke and regenerate it from the panel whenever you need to.

Example

curl https://api.kinapi.es/api/v1/checkins \
  -H "ocp-apim-subscription-key: YOUR_API_KEY"

Account isolation

The API key identifies your account and scopes all the data: a request can only read and modify the check-ins, properties and contracts of your own account. There is no parameter that reaches another account’s data — the isolation is structural, not a convention.

Authentication errors

401 Unauthorized — no key, or an invalid/revoked key

{ "error": "unauthorized" }

Keep the key in a secrets manager and use it only from your server. Never ship it in browser code or a mobile app: anyone could extract it.

Getting an API key

In the panel, under API, press “Generate key” and give it a name (for example “Production”). The key is shown only once — copy it there and then; after that only its hash is stored and there is no way to recover it. You can generate several keys (one per environment or integration) and revoke any of them at any time without affecting the rest — that is how you rotate one: generate the new key, update your integration, revoke the old one.

Test keys

Keys starting with kinapi_test_ belong to your account’s test mode: the same API over separate data, where filing is answered by a simulator and nothing is billed. You create them the same way, from the panel with test mode on. The prefix is there so you can tell them apart at a glance; what separates them from live is the account they belong to, so a test key cannot see or change anything live.