Authentication
Authentication
Every request except the public verification endpoints carries an API key as a bearer token.
curl https://api.kernsignal.ai/v1/audits/aud_... \ -H "Authorization: Bearer $KERNSIGNAL_API_KEY"
Keys
| Prefix | Mode | Behaviour |
|---|---|---|
ks_test_ | test (sandbox) | Runs the same code as live. Never billed. Results leave the live system after 24 hours. Verification records made with it are marked as sandbox. |
ks_live_ | live | Billed per audit. Results stay in the live system for 30 days. |
A key is the prefix followed by 32 letters and digits. Kernsignal stores only a hash of it, so a lost key cannot be recovered; ask for a new one.
Keep keys secret
- Keep keys on your server. Do not put one in a web page, a mobile app or a repository.
- Read it from an environment variable, as in the examples.
- If a key may have leaked, email hello@kernsignal.ai and it will be revoked.
Public endpoints
These need no key, so you can let others call them: GET /v1/verify/{verification_id}, GET /v1/verify/{verification_id}/badge.svg, GET /v1/verification-keys and GET /v1/health.
Failures
A missing, malformed or revoked key returns HTTP 401 with an authentication_error. See Errors.