Getting started
Authentication
API keys, their scopes, and how to send them.
Every request needs an API key, except the OpenAPI document. Make keys in the app under Settings → API keys; you'll confirm your password first. You can have up to 10.
Sending your key
Send it as a bearer token:
Authorization: Bearer kt_live_0193f1b27c4e7a1d9b2a3c5d6e7f8a9b_Xc1…or in an X-API-Key header. Keys start with kt_live_, followed by an id and a secret, so secret scanners (GitHub's included) can spot a leaked one. Kritano stores only a hash of the secret: if you lose a key, make a new one.
Scopes
A key acts as you, limited to the scopes you gave it:
| Scope | Lets the key |
|---|---|
audits:read | List sites and audits, and read their scores |
audits:write | Start, cancel and delete audits |
findings:read | Read an audit's findings |
findings:write | Dismiss or acknowledge findings |
exports:read | Download CSV and JSON exports |
scans:run | Scan any public page once, without adding it as a site |
A request a key's scopes don't cover gets 403 with the code missing_scope, and the scope it needs in error.scope. Each endpoint's page lists its scope.
Expiry and revoking
A key can expire after 30, 90 or 365 days, or never. Revoke one in Settings and it stops working at once. Keys also stop working if your plan no longer includes API access (code plan_no_api) or the account is disabled.
A key never has admin powers, even if you're an admin.