Authentication

Choose how your app proves who it is to the Kestrel API.

API keysServer-to-server calls from your own backend.

Create a key in Settings → API keys and send it as a bearer token in the Authorization header. Each key belongs to one project and can be limited to read-only.

Rotate a key at any time without downtime: the old one keeps working for 24 hours. Manage API keys

OAuth 2.0Act for people who sign in with their Kestrel account.

Register your app to get a client ID, then send people to Kestrel to approve the scopes you ask for. Access tokens last one hour and refresh tokens 90 days. Read the OAuth guide

Service accountsFor CI pipelines, cron jobs and other machines.

A service account has its own role and audit trail, so a deploy script never acts as a person. Give it the narrowest role it needs and it stops working the day you remove it.

Webhook signaturesCheck that each event really came from Kestrel.

Every event carries a Kestrel-Signature header: an HMAC-SHA256 of the body made with your endpoint's secret. Reject any event whose signature doesn't match or is older than five minutes.

Bordered Accordion with Icons

More in this category