Kodkila Developers

Every key belongs to one channel. Its prefix tells you what it is and where it may go.

Two kinds of key

Key	Test	Live	Send it as
App key (publishable)	`kk_app_test_…`	`kk_app_live_…`	`X-App-Key`
Server key (secret)	`kk_test_…`	`kk_live_…`	`Authorization: Bearer` or `X-Api-Key`

App keys name your channel from a browser or a phone app and read its public data. On their own they grant nothing private: a user still signs in for anything that is theirs.

Server keys act for your channel from your own server, with the scopes you choose. Treat them like passwords. Kodkila stores only a hash, so the full key is shown once when you create or rotate it. A lost key can’t be recovered; rotate it instead.

Keys made before the rename to Kodkila start with wm_ instead of kk_. They keep working exactly like the new ones.

Test and live

Test or live is chosen by the key, never by the URL. There is no test host. Test keys read your channel’s real data and refuse every write with 403, and payments stay in demo mode. Live keys can write, within their scopes, once your business is verified.

A write with a test app key

{
  "success": false,
  "statusCode": 403,
  "message": "Test app keys can only read. Use a live app key to make changes.",
  "errorCode": "FORBIDDEN"
}

Scopes

A server key can call a route only when the route accepts one of its scopes. Every other route refuses API keys with 403, public routes included. Signed-in users are not limited by scopes. The scopes you can grant depend on the apps installed on your channel; the console lists them when you create a key.

Scope	What it opens
`products:read`, `products:write`	Read, create, change and remove the channel’s products
`orders:read`, `orders:write`	Read the channel’s orders as the seller and move them along
`crm:read`, `crm:write`, `customers:read`	The channel’s CRM and customers
`media:read`, `media:write`	The channel’s files, videos and playback links
`search:read`, `search:write`, `search:admin`	Search the channel’s indexes, write to them and manage them
`features:read`, `features:write`	Read and change feature flags, including the kill switch
`profile_data:read`	The app data your app saves on its users’ profiles
`channel:config:read`	The channel’s app config, secrets included
`updates:write`	Publish app updates (live keys)

Where a key may be used

A key works only for its own channel. Naming another channel in the path, body or x-ref answers 403.
A server key acts with the rights of the person who made it. If they stop managing the channel, the key stops working.
You can limit a server key to a list of IP addresses or ranges, and give it an expiry date.
Browser calls are accepted only from your channel’s domains and allowed origins, plus localhost for test keys.
An unknown, revoked or expired key answers 401. Revoking takes effect within 30 seconds everywhere.

Check a key

Terminal

curl https://api.intersink.com/v1/channel/me \
  -H "Authorization: Bearer kk_test_…"

The answer names the key’s channel and includes api_key with its mode and scopes. For an app key, use GET /channel/key-info with X-App-Key, as in Getting started.

Rotate and revoke