API Access

For programmatic access — pulling findings into your own tooling, or integrating Kansyn into a script — use an API key instead of signing in.

Creating a key

Under Settings → API Keys, create a key. The raw key is shown exactly once, at creation — Kansyn only ever stores a hash of it, so if you lose it, you'll need to revoke it and create a new one rather than retrieving the old value.

Using a key

Send it as an X-API-Key header on any request instead of a Bearer token:

GET /events
X-API-Key: <your key>

Every product endpoint works identically for either auth method. API keys are scoped to the member role regardless of who created them — routes gated to owner/admin (like inviting a teammate) aren't reachable via API key, only via a real signed-in session.

Revoking a key

Revoking is immediate — the very next request with a revoked key gets a 401. Revocation is soft (the key's record is kept, marked revoked, not deleted) so "when was this key revoked" stays answerable if you ever need to investigate a leaked-key incident.