Authentication

Every request to the Krino API carries an API key. It goes in the X-API-KEY header; it is not accepted in a query string or in the body.

curl https://api.krino.uk/api/decisions \
  -H "X-API-KEY: $KRINO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

Creating a key

In the management UI: Settings → API Keys. The key is shown once at creation and never again — only a digest of it is stored.

Do not put the key in source code, in a committed env file, or in a client application. A Krino key is the authority to make decisions on your behalf.

Role

Every key has a role. The narrowest role an integration needs is ApiClient: it can send events and ask for decisions, but cannot reach rule or user management.

Rotating a key

Keys do not expire; rotation is your call. The order that avoids downtime:

Create the new key

The old one keeps working.

Deploy your services with it

Make sure they have all switched over.

Delete the old one

Requests with a deleted key get 401.

Errors

Status	Meaning
`401`	Header missing, key invalid, or key deleted
`403`	Key is valid but not authorised for this operation
`429`	Rate limit exceeded — see Errors

Getting started

Platform

Decisions

Data and events

Signals and screening

Self-hosting

Authentication

Creating a key

Role

Rotating a key

Errors

​Creating a key

​Role

​Rotating a key

​Errors

Creating a key

Role

Rotating a key

Errors