CLI logins
The Kenso CLI's browser login: start a login, then poll it until it hands the CLI an API key.
No credential. deviceName (1 to 100 characters) is shown on the approval page. Returns the loginId to poll POST /v1/cli/logins/token with (keep it private), the userCode to show, the verificationUrl to open, expiresIn seconds and the poll interval in seconds.
Parameters
Request body
application/json, optional.
Response 201
data is a CliLoginCreatedModel.
POST /v1/cli/logins/token. Keep it private.XXXX-XXXX: the code the person confirms in the browser.curl -X POST "https://api.ken.so/v1/cli/logins" \
-H "Authorization: Bearer $KEN_API_KEY" \
-H "Ken-Version: 2026-11-02" \
-H "Content-Type: application/json" \
-d '{
"deviceName": "string"
}'{
"success": true,
"data": {
"loginId": "string",
"userCode": "string",
"verificationUrl": "https://example.com",
"expiresIn": 1,
"interval": 1
}
}No credential: loginId is the credential. Once the login is approved, returns the new apiKey with its apiKeyId, the chosen workspaceId, the approver's email and the key's expiresAt, one time, and deletes the login. Otherwise 400 with error.code set to authorization_pending (keep polling), slow_down (polled sooner than interval; wait longer), access_denied or expired_token (stop; start a new login).
Parameters
Request body
application/json, optional.
loginId the create returned.Response 200
data is a CliLoginTokenModel.
ken_...). Returned once.GET /v1/api-keys lists it.curl -X POST "https://api.ken.so/v1/cli/logins/token" \
-H "Authorization: Bearer $KEN_API_KEY" \
-H "Ken-Version: 2026-11-02" \
-H "Content-Type: application/json" \
-d '{
"loginId": "string"
}'{
"success": true,
"data": {
"apiKey": "string",
"apiKeyId": "string",
"workspaceId": 812,
"email": "[email protected]",
"expiresAt": "2026-09-23T15:02:11Z"
}
}