Authentication

All API requests require an API key passed via the X-API-Key header.

API Key Format

Keys follow the format: kolbo_live_<40 hex characters>

Creating a Key

Via Dashboard (Recommended)

Go to Developer Console and click Create Key.

Via API

This endpoint requires a JWT token from your browser session (not an API key):

curl -X POST https://api.kolbo.ai/api/api-keys \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "My Integration", "permissions": ["read", "write"], "expiresInDays": 365}'

Response:

{
  "status": true,
  "data": {
    "id": "key_id",
    "keyPrefix": "kolbo_live_abcdef...",
    "name": "My Integration",
    "permissions": ["read", "write"],
    "createdAt": "2026-03-05T10:00:00Z",
    "expiresAt": "2027-03-05T10:00:00Z"
  },
  "fullKey": "kolbo_live_abc123def456...",
  "message": "API key created. Save the full key -- it will not be shown again."
}

Save the fullKey immediately -- it is only returned once at creation time.

Using the Key

Include it in every request via the X-API-Key header:

curl https://api.kolbo.ai/api/v1/models \
  -H "X-API-Key: YOUR_API_KEY"

JavaScript (fetch):

async function main() {
  const response = await fetch("https://api.kolbo.ai/api/v1/models", {
    headers: { "X-API-Key": "YOUR_API_KEY" }
  });
  const data = await response.json();
  console.log(data);
}
main();

Python (requests):

import requests

response = requests.get(
    "https://api.kolbo.ai/api/v1/models",
    headers={"X-API-Key": "YOUR_API_KEY"}
)
print(response.json())

Managing Keys

List Keys

curl https://api.kolbo.ai/api/api-keys \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

Get Key Details

curl https://api.kolbo.ai/api/api-keys/KEY_ID \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

Revoke a Key

curl -X DELETE https://api.kolbo.ai/api/api-keys/KEY_ID \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

Limits

Maximum 5 active keys per user
Keys expire after the configured duration (default: 365 days)
Permissions: read and write only (admin keys cannot be self-created)
Expiration range: 1-730 days

Security Best Practices

Store keys in environment variables, never in code
Use separate keys for different integrations
Revoke unused keys promptly
Monitor usage via the key details endpoint

On this page