Authentication

Every authenticated endpoint accepts one header:

Authorization: Bearer <token>

where <token> is either a session token (JWT from signup/login, 30-day) or a platform API key (klw_...). API keys are also accepted via an X-API-Key header for tools that can't set Authorization.

Session tokens

POST /api/auth/signup {email, name, password} → {token, user} — or POST /api/auth/login with the same shape for an existing account. Sessions suit dashboards and short scripts.

API keys (recommended for integrations)

curl -X POST https://klaw-voice.netlify.app/api/auth/api-key -H "Authorization: Bearer $TOKEN"

• The raw klw_ key is returned once; only a SHA-256 hash is stored.
• Rotate by calling POST again (the old key stops working).
• Revoke with DELETE /api/auth/api-key.
• Manage from the dashboard under Settings → API key.

API-key traffic is rate-limited to 100 requests/minute per key; over-limit requests get 429 with a Retry-After header. See Rate limits.

Stream tokens

Server-sent-event URLs can't safely carry a permanent key, so mint a short-lived one:

curl -X POST https://klaw-voice.netlify.app/api/v1/events/stream-token -H "Authorization: Bearer $KLAW_KEY"

Returns a klwst_ token valid ~120 seconds, used only as ?token= on GET /api/v1/events/stream. Permanent keys are refused in stream URLs.

MCP

tools/call on https://klaw-voice.netlify.app/api/mcp requires Authorization: Bearer klw_.... Discovery methods (initialize, tools/list, ping) are open.