Authentication¶
Every request to the Kwirker API carries a bearer token in the
Authorization header:
There are two ways to get one.
API keys (recommended for automation)¶
For scripts, backends, and integrations, create a long-lived API key.
- Sign in at app.kwirker.com.
- Go to Settings → API keys.
- Create a key and copy it immediately — we show it only once and store only a hashed version, so it can't be retrieved later.
Use it directly as the bearer token:
An API key acts as you, within your organization, and is bound to your permissions. Treat it like a password.
Keep keys out of source control
Store keys in a secrets manager or environment variable, never in code or a committed config file. Rotate a key from Settings → API keys the moment you suspect it's exposed; revoking is instant.
Single sign-on (interactive apps)¶
The web and mobile apps sign in with OpenID Connect single sign-on. Your organization can connect its own identity provider — Google, Microsoft Entra, Okta, or any standard OIDC/SAML provider — so your team signs in with the accounts they already have. Admins set this up in Settings → Authentication.
For interactive applications you build, use the standard OIDC authorization-code flow against your organization's sign-in URL; the resulting access token is the bearer token for API calls. For everything else, prefer an API key.
Organizations¶
Your token is scoped to the organizations you belong to. API paths are
organization-scoped — for example
https://app.kwirker.com/api/v1/tenant/{organization_id}/agents — and the API
rejects any request for an organization you're not a member of.
Errors¶
| Status | Meaning |
|---|---|
401 Unauthorized |
Missing, malformed, expired, or revoked token. |
403 Forbidden |
Authenticated, but your permissions don't allow this action. |
Next¶
- API overview — base URL, formats, pagination, rate limits.
- API reference — every endpoint, rendered from the schema.
- Webhooks — receive events and let skills be called from outside.