Authentication

API keys, OAuth 2.0 for tenanted access, rate limits, and how to authenticate every request.

The Kaminari Ad REST API lives under https://app.kaminari.ad/api/v1 and authenticates every request with a Bearer token. There are two kinds.

API keys

For server-to-server automation, create an API key under Account -> API Keys and send it as a Bearer token:

curl https://app.kaminari.ad/api/v1/scans/<scan_id> \
  -H "Authorization: Bearer $KAM_API_KEY"

Keys are scoped to your organization and carry the permissions of the role they were issued under. Revoke a key any time from the same screen; revocation is immediate.

For third-party apps and AI agents that act on behalf of a user, Kaminari Ad is a full OAuth 2.0 Authorization Server (authorization code + PKCE, refresh tokens, dynamic client registration). Access tokens are sent as Bearer tokens exactly like API keys. See OAuth & connected apps.

Rate limits

Requests are rate limited per credential. When you exceed the limit the API returns 429 Too Many Requests; back off and retry. High-volume workloads should prefer bulk submission over many single calls.

Errors

Errors use standard HTTP status codes and a JSON body with a detail string and, where the UI needs to branch on semantics, a machine code (for example billing.insufficient_funds).