Authentication
Anonymous by default. An API key raises the rate budget and unlocks the keyed refresh.
Nine of the ten v1 operations work anonymously. Omit the Authorization header entirely. Sending a Kyro API key raises the rate budget to the key's plan and unlocks the one keyed operation, POST /api/v1/interaction-graph/{wallet}/refresh:
Authorization: Bearer kyro_live_...The header is only validated when present. A malformed, unknown or revoked key is rejected with 401 INVALID_KEY. Calling the refresh without a key answers 401 NOT_ALLOWED.
Keys during beta
API keys are granted by review during the beta:
- Request access by email at arcidentity.build@gmail.com with your project, expected volume and use case. The pricing page has the same request buttons per plan.
- Approved accounts manage keys in the Kyro Console. Keys are issued per organization, share the organization's plan budget and are capped by plan (Developer up to 2 active keys, Plus 5, Pro 8, Partner 12 by default).
- Keys are shown once at creation and stored only as a SHA-256 hash. They can be rotated, paused or revoked at any time; a revoked key answers
401 INVALID_KEY. - The Developer plan is free during the beta. Plus and Pro are activated by the Kyro team on request; nothing is charged through the console.
Keys are server-side secrets. A key shipped to a browser is handed to every visitor; keep it in your backend and call Kyro from there.
Kyro never asks for private keys or seed phrases. Console sign-in proves wallet ownership by signature only. The API itself needs no wallet connection at all.