API & integrations

Create an OpenAPI token

If enabled for your account, open OpenAPI Token management, also accessible through system settings. Give each integration a recognizable name and an appropriate expiration time.

The full token is shown only once. Store it in server-side secret management, never in browser code, URL parameters or public repositories. Revoke tokens for retired integrations.

Authenticate a request

The gateway accepts an OpenAPI token in the request header:

Authorization: Bearer <OPENAPI_TOKEN>

Send requests to your own instance domain. Tokens do not bypass resource permissions.

Discover the contract first

Directory functions expose typed input schemas. Verify the full path, function type, action, input fields and response structure before invoking one. Start with a read-only or low-risk call.

Directory functions implement business capabilities; platform APIs manage workspaces, identities and permissions. Do not expose internal service ports. Consult your deployed version and its source for exact endpoint contracts.

Build an application

Use the independent kageos-sdk for business applications. Platform code lives in the main repository. Download the developer toolkit for supporting workflows.

Check locally, build on the platform, then verify real form, table or chart calls. Compilation alone is not evidence that deployed business behavior works.