Authentication

Every public API request requires your account’s API key in the X-API-Key header.

Create an API key

1. Sign in to the customer dashboard.
2. Open Developer API.
3. Choose Create API key and copy the complete value. You can copy it again later with Copy API key on the Developer API page.

Your account must be active. Sending OTP calls also requires a package with API access, sufficient balance, and an available sender.

Request headers

X-API-Key: YOUR_API_KEY
Content-Type: application/json

Content-Type is needed for requests with a JSON body. A dashboard session cookie does not replace the API key for these endpoints. Use X-API-Key, rather than a Bearer token.

curl 'https://api.kokilcloud.com/v1/calls/CALL_ID' \
  -H 'X-API-Key: YOUR_API_KEY'

Keep the key on your application server in an environment variable such as KOKILCLOUD_API_KEY. Do not put it in browser JavaScript, mobile application bundles, public repositories, or client-side logs.

Rotate or revoke a key

Each account has one current API key. Generating a replacement invalidates the previous key immediately. Update your server’s environment and restart or reload your integration after replacing a key.

Choose Revoke in Developer API to disable the current key. Requests with an invalid, missing, replaced, or revoked key receive 401 Unauthorized.

Account access

An inactive account receives 403 Forbidden. A package without API access cannot create OTP calls. API keys are tied to their customer account: call status requests cannot read another customer’s calls.