How do I authenticate API requests?

The public API authenticates with two headers on every request: X-Workspace-ID (your ws_… identifier) and X-Secret-Key (from Settings → API Access). Treat the secret like a password — it grants full workspace access via the API. If it leaks, regenerate it from the same screen; the old key stops working immediately.

Example

curl https://api.usekora.app/public/v1/tickets \
  -H "X-Workspace-ID: ws_YOURID" \
  -H "X-Secret-Key: kora_sk_YOURKEY"

Limits

Requests are rate-limited per workspace (50,000/day while your wallet holds credits) and every 400 responses meters 1 credit. Responses include X-RateLimit headers so integrations can back off gracefully.