Quickstart
Connect the Public API integration, mint a scoped token, and make your first authenticated request in about five minutes.
1. Connect the Public API integration
A token does nothing until the workspace connects the Public API
integration. Tokens created before it is connected are refused with 403.
This is deliberate: disconnecting is the kill-switch — it stops every token at
once without destroying any of them, which is what you want while
investigating something rather than a one-way revocation.
In Krrim, go to Integrations → Public API and connect it. Only an organization owner or admin can.
2. Create a service account
A token authenticates a service account, not the person who created it. A service account is a real member of the workspace with a role you choose, so its permissions are decided deliberately instead of inherited from whoever happened to click the button.
It cannot sign in — no password, no SSO — and it cannot hold the owner or
guest role.
3. Mint a token
Integrations → Public API → New token. You choose:
Service account
The principal. Its role caps everything the token can do.
Projects (optional)
Restrict the token to specific projects. Empty means every project the service account can already see.
Allowed IPs (optional)
A CIDR allowlist. Requests from anywhere else are rejected before the token is even checked.
Expiry
Required. Every token expires; there is no perpetual token. Pick the shortest window your deployment can rotate within.
The full token value is shown once, on creation, and never again — only its
krm_live_xxxxxxxx prefix is stored in a readable form. Put it straight into
your secret store.
4. Make a request
curl https://acme.krrim.com/api/v1/projects/ \
-H "Authorization: Bearer krm_live_a1b2c3d4XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"{
"success": true,
"message": "Success",
"data": [
{ "id": 12, "key": "APOLLO", "name": "Apollo", "is_archived": false }
],
"pagination": { "count": 1, "limit": 50, "offset": 0 }
}Send the token in the Authorization header — never in a query string.
Query strings are written to access logs, forwarded in Referer headers and
kept in browser history. The API rejects a token presented any other way, and
rejects one carried over plain HTTP.
5. Read your rate-limit budget
Every token-authenticated response carries the current budget, so you never have to back off blindly:
X-RateLimit-Limit: 120
X-RateLimit-Remaining: 118
X-RateLimit-Reset: 1756100000See Rate limits for the two tiers and which one these headers describe.
What to read next
Krrim for developers
A REST API over the same endpoints the Krrim app uses, reachable with scoped tokens that authenticate a service account rather than a person.
Authentication
Bearer tokens that authenticate a service account, how a request finds its workspace, and the distinct error code behind every kind of refusal.