Authentication

Every request carries a bearer token:

Authorization: Bearer <token>

There are two kinds of token. Both are tied to exactly one KLCT account.

Account API key

The simplest option, for your own scripts and servers.

Sign in to KLCT as the account's main admin.
Open your Profile page and find the API key section.
Generate a key and store it somewhere safe. It is shown once.

An account API key can use every endpoint that is not marked first-party. It carries all scopes, so treat it like a password. Regenerating the key revokes the old one at once.

export KLCT_API_KEY="12|aBcDeF..."
curl "https://app.klctai.com/api/platform/account" -H "Authorization: Bearer $KLCT_API_KEY"

Two things an account key cannot do: manage webhook subscriptions (those belong to an OAuth connection) and call first-party endpoints that use the shared machine token.

OAuth access token

For a product that connects to other people's KLCT accounts. The customer approves exactly the scopes they are comfortable with and can revoke the connection at any time. See OAuth.

Scopes

Scopes narrow what an OAuth token can do. A request without the scope it needs is refused with 403:

{ "error": "insufficient_scope", "error_description": "This token does not have the \"tickets:write\" scope." }

Scope	Grants
`identity`	Confirm which KLCT account this is. No data access by itself — just proves the connection belongs to one specific KLCT account.
`contacts:read`	Read contacts. List and look up this account's contacts.
`contacts:write`	Create and update contacts. Add new contacts and edit existing ones. Never deletes a contact.
`calls:read`	Read call activity. List calls made or received by this account, with outcome and duration.
`tickets:read`	Read support tickets. List and open this account's support tickets and the customer-visible conversation on each. Internal notes are never shown.
`tickets:write`	Create and update support tickets. Open tickets, change their status, priority or due date, add internal notes and send replies to the customer. Never deletes a ticket.
`conversations:read`	Read chat conversations. List and open this account's live chat conversations and their messages. Internal notes are never shown.
`conversations:write`	Reply to and resolve chat conversations. Send a team reply into a chat conversation, which hands it to a person, and mark a conversation resolved.
`changelog:read`	Read the portal changelog. List and open this account's changelog entries, drafts included.
`changelog:write`	Write the portal changelog. Create and edit changelog entries, and publish them to the customer portal. Never deletes an entry.
`feedback:read`	Read feedback and the roadmap. List customer feedback posts with their votes and status, and see the public roadmap. Customer names and emails are never included.
`branding:write`	Set your brand (logo, colours, font). Update this account's logo, colour palette, website and typeface so KLCT emails, pages and social images match the connected platform. Never reads or deletes anything else.
`sequences:trigger`	Trigger sequences from platform events. Forward an event (order placed, cart abandoned, etc.) to enroll a matching contact in a KLCT sequence.
`webhooks:manage`	Manage its own webhook subscriptions. Register and remove URLs that KLCT calls when an event happens in this account.

identity is always granted. Account API keys pass every scope check.

Keep tokens safe

Never put a token in browser code, a mobile app bundle or a public repository. Call the API from your server.
Use one key per integration so you can rotate them independently. Generating a new account key revokes the previous one.
Access tokens from OAuth expire after one hour. Use the refresh token to get a new one.
If a token leaks, revoke it: regenerate the account key, or disconnect the app under Integrations in KLCT.