Use Kernall
Projects & API keys
Create the project once, protect its key, and rotate credentials when needed.
Two authentication paths
| Who | Authentication | Can do |
|---|---|---|
| Agent | Project Bearer key | Check actions and poll confirmation status. |
| Owner | Authenticated identity supplied by Sites | Bootstrap, rotate keys, manage policy, inspect logs, resolve reviews. |
| Local developer | Automatic localhost / 127.0.0.1 identity | Use owner endpoints locally without hosted login. |
Database access is scoped to the authenticated project. A key cannot edit policy or approve reviews. Use a consistent hostname locally; the development identity is shared for the instance and is not multi-user authentication.
Create or load a project
export KERNALL_BASE_URL="http://localhost:3000"
curl --fail-with-body -X POST "$KERNALL_BASE_URL/api/projects/bootstrap" \
-H 'Content-Type: application/json' \
-d '{"name":"My first project"}'The optional name is limited to 80 characters. There is one project per owner; bootstrap is not a rename endpoint or project switcher.
Store the creation response’s raw key. Later responses include metadata only: ID, name, prefix, creation, last-use, and revocation timestamps.
Store and send the key
Keys start with kern_live_. Server keys use 32 random bytes and are stored as SHA-256 hashes plus display metadata. Raw keys cannot be recovered from the stored hash.
Use the Authorization header. Keep secrets out of source control, public client bundles, URLs, screenshots, and agent conversation text. Use trusted server-side adapters for browser products.
The prefix does not mean the key is a production credential. A key belongs to the database that created it; a local key does not automatically work on a hosted instance.
Rotate a key
# Local development: immediately revokes every active project key.
curl --fail-with-body -X POST "$KERNALL_BASE_URL/api/api-keys/rotate"This immediately revokes all active project keys and returns one new raw key. Save it and update every integration. There is no overlap window.
Rotation does not erase logs, reset policy, or cancel confirmations. A new key for the same project can poll existing reviews. Individual revocation and key-scope management endpoints are not implemented.
Using a deployed instance
Use your deployed HTTPS origin as the base URL. Owner endpoints depend on the hosting layer’s authenticated identity; arbitrary curl requests do not supply it.
A private host may also require access before a request reaches Kernall. An API key is not a hosting-access bypass. Validate the intended external-agent access path before adopting a hosted workflow.
Do not simulate trusted hosting headers from external clients. A self-hosted deployment needs its own trusted identity boundary.