Authentication

Base URL

https://app.kawlya.com/api/integrations/v1

Bearer key

Every request requires an Authorization header. Keys start with kwl_ followed by 48 hexadecimal characters. The key is the workspace identity; do not pass an additional tenant ID.

Authorization: Bearer kwl_<48 hex chars>

Creation and revocation

Create keys in Integrations → API & Webhooks. The value is shown only on creation; only a SHA-256 hash is stored server-side. Unknown and revoked keys return the same generic 401 response.

Check identity

curl 'https://app.kawlya.com/api/integrations/v1/me' -H "Authorization: Bearer $KAWLYA_API_KEY"

{
  "tenant": {
    "id": 42,
    "name": "Garage Dupont"
  }
}

Limits and errors

The limit is 120 requests per minute per key. Exceeding it returns 429 with Retry-After: 60. Wait before retrying. A 401 means a missing or invalid key. When creating a webhook, 403 not-entitled means the plan lacks the integrations entitlement.