Authentication

KiBee uses two credential types: a publishable key for browser SDK calls and a secret key for server-to-server admin calls. Never use a secret key in browser code.

Publishable key (browser SDK)

Publishable keys begin with kb_pub_ and are safe to embed in your client-side bundle. They authenticate SDK requests alongside your websiteId.

The SDK sends two headers automatically when both credentials are configured:

X-KiBee-Website-Id: kb_ws_your_workspace
Authorization: Bearer kb_pub_live_your_key

The API validates that the key belongs to the workspace identified by X-KiBee-Website-Id and that the request Origin is in your allowed domains list.

Secret key (server-to-server)

Secret keys are for server-side calls only — never expose them in browser code. Pass them in the X-KiBee-Key header.

curl https://api.kibee.ai/admin/flows \
  -H "X-KiBee-Key: kb_live_your_secret_key"

Admin JWT (Auth0)

The Admin Console authenticates via Auth0. After sign-in, the web app issues a short-lived HS256 JWT and passes it as a Bearer token to admin endpoints. Supply the target workspace in X-KiBee-Workspace.

Authorization: Bearer <kibee-issued-jwt>
X-KiBee-Workspace: <workspace-uuid>

CORS and allowed domains

Publishable-key requests are validated against your workspace's allowed domains list. If the Origin header is not on the list, the API returns 403 Forbidden.

Manage allowed domains in Admin → Settings → Security. Leave the list empty to allow all origins — useful during local development.

Obtaining keys

1. Sign in to the Admin Console.
2. Go to Settings → API Keys.
3. Click Create key and choose Publishable (browser SDK) or Secret (server-side calls).
4. Copy the key immediately — it is not shown again after closing the dialog.