The public API uses app tokens (JWT) created in the Karzoun Developer dashboard.
Send the token on every request:
Every GraphQL request is a JSON POST with your token in headers.
Permissions
Apps can be scoped to user groups or allowed for all users. Create apps with the minimum permissions needed for your integration.
Use the currentUser query to confirm authentication before building integrations.
Security
- Never expose app tokens in browser-side code
- Use MCP and server-side agents with tokens on the backend only
- Rotate tokens by creating a new app and revoking the old one
Next steps
