Authentication

Credentials

Every request carries an API credential in the Authorization header:

Authorization: Bearer <app_id>.<secret>

An administrator in your organisation creates and revokes credentials from the AlphaToken KYT console, under Settings → API Keys. Creating a credential requires the administrator role. The secret is shown once at creation and cannot be recovered afterwards — store it securely. To rotate a credential, an administrator creates a new one and revokes the old one.

Which credential to use on this site

The Try It controls in the API Reference send live requests to the production API at kyt-api.alphatok.xyz. There is no sandbox: the requests are real, they are billed against your quota, and the credential you type is transmitted from your browser. Use a test credential with a low quota for anything you run here, and keep your production integration credential out of this site. Credentials typed into Try It are held in memory for the page session only — they are never written to browser storage — but that is not a reason to enter a production credential.

Status codes

Every error response carries the same body shape, and reason is the field to branch on — not the HTTP status, which several different outcomes share. See Status Codes for every status and reason the endpoints on this site return, and what to do with each.

Try it from your terminal

curl https://kyt-api.alphatok.xyz/api/v1/whoami \
  -H "Authorization: Bearer <app_id>.<secret>"