Create and manage API keys

An API key lets a script, a scheduled job or an AI tool that can't sign in call the Kenso API. Each key acts as you, with your role: it can do what you can do, and nothing more. Keys live in Settings › API keys: press G then , to open Settings, then click API keys under Integrations.

To connect Claude, ChatGPT or another AI tool, signing in is better than a key. See Use Kenso from Claude or ChatGPT. Use a key only when the tool can't sign in.

Before you start

Creating a key needs the Integrations and API keys permission. Admins have it. Without it, Kenso refuses the key.
Keys are personal. The page lists only your own keys. Each teammate creates and revokes their own.
You can hold up to 20 active keys.

Create a key

Open Settings › API keys and click Create key. With no keys yet, the button sits in the middle of the page.
Kenso adds a key named New key and a number, with no expiry date.
Under Copy this key now, click Copy, then paste the key where your script or tool keeps secrets.
Close the box with the X. After that, or once you leave the page, you can't see the key again.

A key starts with ken_. The page can't rename a key or set an expiry date, so note which key you gave to which tool.

What the list shows

Column	What it means
Name	The key's name, such as New key 2
Key	The first characters of the key, then the API version it is pinned to, such as API version 2026-11-02, or Legacy
Created	The day you created it
Last used	Never, Today with a time, or the day of the last call

Right-click a key for Copy key prefix, to match a key to the tool that uses it.

Call the API with your key

Every call goes to https://api.ken.so/v1, with your key as a Bearer token:

curl https://api.ken.so/v1/campaigns \
  -H "Authorization: Bearer ken_..." \
  -H "X-Ken-Workspace-Id: 42"

The workspace. If you belong to one workspace, you can leave out X-Ken-Workspace-Id. If you belong to several, send it with the workspace's number, the one after app.ken.so/ in your browser.
Your permissions. A call your role doesn't allow answers 403 permission_denied. If an admin changes your role or removes you, your keys change with you.
No key admin with a key. A key can't create other keys, and it can only revoke itself. Create and revoke keys on this page.

Click Developer docs under the page title for every route, with examples.

Rate limits

Kenso limits API key calls per workspace, per minute:

Kind of call	Limit
Read (`GET`)	3,000 a minute
Write (`POST`, `PATCH`, `PUT`, `DELETE`)	1,200 a minute
Bulk operations and imports	120 a minute, and 1,000,000 items a day
Heavy (search, exports, analytics, AI runs)	60 a minute
Sensitive (API keys, members, billing, webhooks, integrations)	30 a minute

All calls together are capped at 1,000,000 per workspace per day. These are the standard limits, and your plan can change them. Over a limit, the API answers 429 rate_limited with a Retry-After header. Spread bulk work over the day.

Pin a key to an API version

A new key is pinned to the newest API version, so a script needs no version header. A Ken-Version header on a request wins over the pin. To change the pin, right-click the key and pick Switch to legacy API or Switch to API 2026-11-02. Kenso confirms with the key's name and its new version.

Legacy means no version: a call without Ken-Version gets each route's older shape, and a route that exists only in the new reference answers 404. Send Ken-Version with a legacy key.
A version stays supported until 12 months after the next one ships. Once a key's version retires, its calls without a Ken-Version header answer 400 version_retired. Switch the key to a newer version to use it again.

Revoke a key

Click Revoke on the key's row, or right-click it and click Revoke key.
Kenso confirms with "Revoked" and the key's name.

Every script or tool that uses the key stops working at once. There is no confirm step and no undo.

Keep your keys safe

One key per tool. If a key leaks, you revoke only that one.
Never paste a key into a chat, a shared doc or a code repository. It acts as you.
Revoke keys you no longer use. Last used tells you which ones are idle.
Lost a key? You can't see it again. Create a new one, update your tool, then revoke the old one.

What Ken can do here

Press ⌘J and ask Ken which keys you have and when each was last used. Ken can revoke a key after you approve it. It never creates a key or shows one.

If something goes wrong

"You have 20 active API keys and the limit is 20." Revoke a key you don't use, then click Create key again.
Kenso won't create a key. Your role doesn't have the Integrations and API keys permission. Ask an admin.
Every call answers 401. The key is missing, mistyped or revoked. Check the Authorization: Bearer header, or create a new key.
A call answers 400 workspace_required. Your key reaches more than one workspace. Add the X-Ken-Workspace-Id header.
A call answers 404 on a route the docs list. The key is on Legacy. Send a Ken-Version header, or switch the key to the newest version.
"An API key cannot create API keys." Create keys on this page while signed in.