Authentication
KrosAI uses API keys to authenticate requests. You can create and manage API keys in the Dashboard.
API Key Authentication
Include your API key in the x-api-key header of every request.
API Key Format
KrosAI API keys follow the format kros_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, where the prefix indicates the environment (live for production).
All API keys are prefixed with kros_ for easy identification.
Creating API Keys Via Dashboard
1
Create API key
Go to Developers → API Keys
2
Click Create
Click Create API Key
3
Name the key
Enter a descriptive name
4
Select scopes
Select the required scopes
5
Optional: IP restrictions
(Optional) Add IP restrictions
6
Optional: expiration
(Optional) Set expiration date
7
Finish
Click Create
Important: Copy your API key immediately after creation. For security, we only show the full key once.
'
API Key Properties
Name | Descriptive name for identification |
Scopes | Permissions granted to the key |
Allowed IPs | Optional IP allowlist for extra security |
Expires At | Optional expiration date |
Created At | When the key was created |
Last Used | Last time the key was used |
Scopes
Scopes control what actions an API key can perform. Use the principle of least privilege—only grant scopes that are needed.
Available Scopes
| View phone numbers |
| Purchase, configure, and release phone numbers |
| View endpoints |
| Create, update, and delete endpoints |
| View call logs and recordings |
| Initiate outbound calls, hangup calls |
| View webhooks |
| Create, update, and delete webhooks |
| View balance and transactions |
| Add credits, manage subscriptions |
| View API keys |
| Create, update, and revoke API keys |
| Use the Voice SDK to connect calls |
Read-only access for analytics — grant calls:read, numbers:read, and billing:read.
Full access for server-side integrations — grant all numbers, endpoints, calls, and webhooks scopes.
Voice SDK access only — grant voice:connect and calls:read.
{
"scopes": ["voice:connect", "calls:read"]
}
IP Restrictions
For additional security, you can restrict API key usage to specific IP addresses:
{
"allowed_ips": ["203.0.113.50", "198.51.100.0/24"]
}
Requests from non-allowed IPs will receive a 403 Forbidden response.
Key Rotation
We recommend rotating API keys regularly. To rotate a key:
1
Create new key
Create a new API key with the same scopes
2
Update application
Update your application to use the new key
3
Verify
Verify the new key works correctly
4
Revoke old key
Revoke the old key
Bearer Token Authentication
For browser-based applications using the KrosAI Dashboard, we also support Bearer token authentication using JWTs.
Bearer tokens are typically used for dashboard access. For server-side integrations, use API keys.
Error Responses
Invalid API Key
Invalid API Key
{
"error": "Invalid API key",
"code": "INVALID_API_KEY"
}
Missing API Key
Missing API Key
{
"error": "Missing API key",
"code": "MISSING_API_KEY"
}
Insufficient Scope
Insufficient Scope
{
"error": "API key lacks required scope: calls:write",
"code": "INSUFFICIENT_SCOPE"
}
IP Not Allowed
IP Not Allowed
{
"error": "Request from IP 192.168.1.1 not allowed",
"code": "IP_NOT_ALLOWED"
}Key Expired
Key Expired
{
"error": "API key has expired",
"code": "KEY_EXPIRED"
}
On this page
- Authentication