Authentication
Every request to the Kenso API carries an API key from your Kenso account as a Bearer token.
Create a key
In the Kenso app, open Settings > Integrations > API Keys and create a key. The key is shown once, when you create it, so copy it then.
Keep it on your server or in a secret store. Anyone with the key can act as you in your workspaces.
Send it with every request
Pass the key in the Authorization header, with Ken-Version: 2026-11-02:
curl "https://api.ken.so/v1/me" \ -H "Authorization: Bearer $KEN_API_KEY" \ -H "Ken-Version: 2026-11-02"
What a key can do
A key acts with the role you have in the workspace. An endpoint your role cannot use answers 403 with the code forbidden.
When a key is rejected
A missing, invalid or revoked key answers 401. That response comes from the authentication layer in front of the endpoints, so its body is { "error": "Invalid or revoked API key" } or empty, not the usual error object. Branch on the status.
If a key leaks, revoke it in the same settings page and create a new one.