API keys & webhooks

Klient exposes a workspace-scoped REST API and outbound webhooks so your own systems can read workspace data and react to client events.

API keyslink

check_circleKeys are minted by the workspace owner and start with the klk_ prefix.
check_circleThe full key is shown exactly once at creation. Only a hash is stored — nobody (including Kariant) can read your key back later.
check_circleAuthenticate REST calls with the key in the x-api-key header, or with your signed-in session as a Bearer token plus an X-Workspace-Id header naming the workspace.
check_circleKeys created before 2026-07-23 (the plaintext era) are treated as revoked — mint a fresh key.

check_circleRegister an endpoint URL with the events you care about — for example klient.contact.created, klient.invoice.paid, klient.contract.signed — or * for all.
check_circleEvery delivery is signed: the X-Klient-Signature header carries an HMAC-SHA256 of the payload using the secret returned at registration. Verify it before trusting the payload.
check_circleDeliveries also carry X-Klient-Event (the event name) and X-Klient-Delivery (a unique delivery id).
check_circleEach webhook keeps success/failure counters and a delivery log so you can see exactly what was sent and how your endpoint answered.

I lost my API key — can support recover it?expand_more

No. Only a hash of the key is stored. Revoke the lost key and mint a new one.

How do I verify a webhook is really from Klient?expand_more

Compute HMAC-SHA256 of the raw request body with your webhook secret and compare it to the X-Klient-Signature header (sha256=… format).