API keys and scopes

Create a key that can do exactly what one integration needs, and retire it safely.

Updated 23 September 2026

On this page

Why: Every call to the API or the MCP server has to prove which workspace it belongs to and what it may touch.
What: An API key begins kbd_, belongs to one organisation and carries a set of scopes.
How: Create it on the Kabaido API entry in Settings and send it as a Bearer token.

Create a key

Step 1.
Open /app/settings/integrations and open Kabaido API. Keys need the admin role or above; every plan has them.
Step 2.
Choose New key, name it after the integration that will use it and tick its Scopes.
Step 3.
Choose Create key and copy it. This is the only time the full key is shown.

bash

curl "https://kabaido.ai/api/v1/products?search=blade&limit=50" \
  -H "Authorization: Bearer kbd_your_key_here"

A missing, unknown or revoked key gets 401. A key without the scope a route needs gets 403.

Scope	Allows	Also needs
`products:read`	List and search products
`products:write`	Bulk upsert products by SKU
`quotes:read`	List quotes and read one with its lines
`quotes:write`	Reserved: no route or tool uses it yet
`orders:read`	List orders and read one with its lines
`customers:read`	List customers and read one with its contacts
`customers:write`	Upsert customers
`requests:read`	List requests and read one with its messages
`requests:write`	Open a request from enquiry text
`stock:read`	Read stock lines, locations and the movement ledger	Stock
`stock:write`	Record a stock movement through the ledger	Stock
`deliveries:read`	Read deliveries with their lines and packages	Route
`suppliers:read`	Read suppliers and their contacts	Source
`purchase_orders:read`	Read purchase orders with their lines and receipts	Source

Kabaido stores only a hash of each key, so a lost key cannot be recovered: create a new one.
The list shows each key's first characters and when it was last used. Revoking takes effect at once.
Make one key per integration, scoped to what it does: a nightly catalogue push needs products:write and nothing else.

There is no rotate button. Create the new key, deploy it, watch last used move to it, then revoke the old one.