/developer/api-keys). Copy the secret when it is shown. You cannot read it again.
Send it on every request:
x-api-key: kz_live_YOUR_API_KEY is the same thing. Production keys start with kz_live_. Other environments use kz_test_.
Which key to create
Create a personal key when the integration should act as you and stop working if your user is deactivated. A server job that must keep running after you leave needs a workspace key. A workspace key belongs to the workspace. You can cap it with a user group. Unless you are an owner, you have to. Both kinds expire. The default is one year. The longest you can set is two years. Revoke a key from the same page. Revocation takes effect on the next request. A key can call only the scopes you pick.contacts:read can list contacts. inbox:write can read and change inbox data, because write includes read. Sensitive scopes, such as managing apps or webhooks, are limited to owners. An API key cannot create another key.
currentUser checks that the key works. With a personal key it returns you. With a workspace key it returns the key’s own user, not a teammate.
If you are connecting Claude or ChatGPT
Those apps do not take a pasted key. Give them your MCP URL,https://YOUR_SUBDOMAIN.api.karzoun.chat/mcp. They send you through the normal Karzoun login and a consent screen. The token they keep can call only the scopes you approved. Disconnect it in Settings → Connected apps.
Local tools such as Cursor use an API key. See MCP.
Keep the key safe
Store it in a secrets manager or a server environment variable. Do not put it in browser JavaScript, a git repo, or a chat. When a laptop is lost or someone leaves, revoke that key and create a new one. Do not reuse the old secret.Existing app tokens
x-app-token still works until 31 March 2027. Responses include Deprecation and Sunset headers. Do not start anything new this way.
Tokens you already have are listed in Developer → Apps. Convert one into a workspace API key there. The product no longer lets you create a new app token.