Authentication

Send your API key in the Authorization header using the Bearer scheme on every request:

Authorization: Bearer kvc_...

Keys are scoped to a workspace. Requests made with a key count toward that workspace's usage and rate limit. Create and revoke keys in the dashboard.

Failed authentication

If the header is missing or malformed, or the key is unknown or revoked, the API responds with 401:

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "The API key is invalid or has been revoked."
  },
  "request_id": "req_3m9QpXc1rT0aLw7Z"
}

Keep keys server-side

• Call Kovca from your backend. Never embed a key in browser or mobile app code.
• Store keys in a secret manager or environment variables, not in source control.
• Use separate keys for each environment or service so you can revoke one without affecting the others.