Authentication and keys

Every request to the kenari API is authenticated with one API key that starts with kn-. One key works for all models, all providers, and both APIs (OpenAI style and Anthropic style).

kn- API key

API keys are created in the dashboard on the API keys page. The key starts with kn- and is shown only once when created. After that, only its SHA-256 hash is stored, so the original value cannot be viewed again. Copy it and store it somewhere safe as soon as the key first appears.

You do not need a separate key for each model or provider. One kn- key is enough for the whole catalog and both API formats.

Run npx @kenarihq/cli login in a terminal to open the approval page in your browser and store a new key automatically, without copying and pasting it. See kenari CLI.

Note If a key is lost, you cannot recover it. Create a new key in the dashboard, then revoke the old one.

Authorization header

Send the key through the Authorization header with the Bearer scheme:

curl https://kenari.id/v1/chat/completions \
  -H "Authorization: Bearer kn-..." \
  -H "Content-Type: application/json" \
  -d '{
    "model": "step-3-7-flash",
    "messages": [{"role": "user", "content": "Halo"}]
  }'

Call from the browser (CORS)

The /v1 API can be called directly from browser JavaScript. kenari sends CORS headers on /v1 routes, so a fetch from a web page works without a proxy of your own. You can also point a browser tool that accepts a custom API URL at https://kenari.id/v1.

const res = await fetch("https://kenari.id/v1/chat/completions", {
  method: "POST",
  headers: {
    Authorization: "Bearer kn-...",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    model: "step-3-7-flash",
    messages: [{ role: "user", content: "Halo" }],
  }),
});
const data = await res.json();
console.log(data.choices[0].message.content);

The server accepts OPTIONS preflight requests on /v1 with any request headers, so authorization, content-type, x-api-key, and Anthropic headers all pass. Credentials (cookies) are not allowed. /v1 authenticates only from the Authorization: Bearer kn-... or x-api-key header.

Warning A key called from a browser is visible to anyone who opens devtools. This suits local tools, personal projects, and prototypes. A production web app should keep the key on a server and call kenari from there.

The dashboard API under /api stays closed to cross-origin requests. Only /v1 is open to browsers.

Endpoints that need a key

These endpoints reject requests without a valid key:

Endpoint	Needs key
POST /v1/chat/completions	Yes
POST /v1/messages	Yes
POST /v1/images/generations	Yes
GET /v1/account/quota	Yes
GET /v1/models	No

GET /v1/models is public and can be called without a key. If it is called with an admin key, the response includes extra internal fields.

GET /v1/account/quota also rejects shared keys with HTTP 403 (shared_key_not_allowed).

See Chat completions, Messages, and Images for endpoint details.

Wrong or missing key

If the key is missing or wrong, the server returns HTTP 401. The body is plain text, not JSON, because the request is rejected before it reaches the API layer. For the error format on other failures, see Errors.

Managing keys

In the dashboard, you can create, view, and revoke multiple keys at once. Give each key a label so you can tell them apart, for example one key per application, so one key can be revoked without affecting the others.

Key revocation takes effect immediately. The next request using a revoked key will be rejected with HTTP 401.

Account status check

Account status is checked on every request. A suspended account makes all of its keys stop working immediately everywhere, regardless of whether each key is still active.

Warning Account suspension immediately stops all API usage and cannot be bypassed by creating a new key.

BYOK is different

The kn- key on this page belongs to kenari and is used to authenticate to the gateway. This is different from BYOK, which is your own provider key (for example an OpenAI or Anthropic key) that you link so kenari can use it for your requests. See BYOK.