Listen
0:00 / ~2:58
Loading workspacePreparing your latest view
Two ways to authenticate: a signed JWT in an HTTP-only kavanah_session cookie (what the browser app uses — set by the auth endpoints below), or an API key sent as a Bearer token — the right choice for integrating Kavanah with your own app or scripts.
A workspace admin can mint an API key under Settings → API keys. The kvn_live_… token is shown exactly onceat creation — Kavanah stores only a hash, so copy it immediately. Lost keys can't be recovered; revoke and mint a new one from the same panel.
Send it on every request:
Authorization: Bearer kvn_live_...GET/POST /api/settings/api-keys lists and mints keys, DELETE /api/settings/api-keys/[id] revokes one (admin session required — a key can't mint more keys). The list shows only prefixes and last-used timestamps, never secrets.KAVANAH_API_KEY instead of hand-wiring endpoints./cli/authorize, and an ordinary kvn_live_… key is minted for them. Approving needs a workspace admin, just like minting a key in Settings.https://kavanah.ai/api/mcp as a custom connector in Claude and signs in, Claude receives an OAuth token (kvn_oat_…). It acts as that person in the workspace they approved, works only at /api/mcp (never on the REST endpoints), and is listed under Settings → API keys → Connected apps, where they can disconnect it. Any active member may connect.kvn_app_…) are minted per installed community app and act as the app, not a person — see Building Apps./api/auth/signupCreates an account and signs the user in. The response sets the session cookie. password must be at least 8 characters.
{
"firstName": "Ada",
"lastName": "Lovelace",
"email": "ada@example.com",
"password": "an-eight-char-min-password"
}/api/auth/loginExchanges email + password for a session cookie. Pass nextPath to receive a redirect target in the response.
{
"email": "demo@kavanah.ai",
"password": "Demo1234!"
}/api/auth/logoutClears the session cookie. No body required.
/api/auth/forgot-passwordSends a reset link to the email if it exists. The endpoint always returns 200 to avoid leaking which addresses are registered.
/api/auth/reset-passwordConsumes a token from the reset email and sets a new password (also 8-character minimum).
{
"token": "9a1d…",
"password": "a-new-strong-password"
}400 — validation failure, duplicate email, or weak password.401 — invalid credentials, expired token, or missing session./login. If you're writing a server-to-server client, treat 401 as a signal to refresh the session.