Authentication
Per-account bearer keys with optional scopes.
Every request carries a bearer key in the Authorization header:
A key is kg_live_ followed by 48 hex characters. The full secret is shown once, at creation; only a hash is stored.
Getting a key
Create keys in Account → Settings → API keys. API access is included on the Professional and Business plans.
- Copy the key when it is shown. It appears once and cannot be retrieved later.
- Revoke a key at any time. Revoking is permanent.
- If the account drops below the Professional plan, its keys stop authenticating until the plan returns. A plan change is reversible; a revoke is not.
Scopes
A key can be restricted at creation to a subset of scopes, so a key you embed in a dashboard or hand to a contractor cannot do more than you granted. A key created with every box checked (the default) has full access. Calling an endpoint the key was not granted returns 403 insufficient_scope.
| Scope | Covers |
|---|---|
| data:read | Statistics search and fetch, exact-statistic construction, the source registry. |
| chart:read | Reading and listing charts, and exporting them as files. |
| chart:write | Creating, updating, publishing, and deleting charts, and loading data into them. |
| folder:read | Listing and reading folders. |
| folder:write | Creating, renaming, moving, and deleting folders. |
| theme:read | Listing the account's themes. |
The scope each endpoint requires is listed on the endpoints page.
Treat a key like a password. It carries the account's data, and with write scopes it can change its charts. Keep it server-side, and revoke a leaked key from Settings.