Keys and access
App keys
Section titled “App keys”Each app has three keys. They are shown in full only when the app is created or rotated.
| Key | Format | Used by | Can do |
|---|---|---|---|
| Public key | pk_... |
The app, the web page | Submit receipts, restore, read its user’s state, test store, web checkout, test ads. Sent as X-Kasskeep-Key |
| Secret key | sk_... |
Your backend | Read customers with full transaction details, read the event log. Sent as Authorization: Bearer |
| Webhook secret | whsec_... |
Your backend | Verify the Kasskeep-Signature header |
The public key is not a secret, but it only reaches data of the user id it is asked about. Kasskeep stores only a SHA-256 hash of the secret key, and the webhook secret encrypted.
Rotate keys with POST .../keys/rotate or npx @kasskeep/cli apps rotate-keys --id app_xxx [--webhook-secret]. The old public and secret keys stop working immediately. Add --webhook-secret (or {"webhook_secret": true}) to replace the webhook secret too.
App keys cannot call the admin API.
Members and roles
Section titled “Members and roles”People sign in to the admin API with an email address, a password and a TOTP code. Two-step verification is mandatory: a new member’s first session can only enroll TOTP.
| Permission | owner | admin | developer | readonly |
|---|---|---|---|---|
| View tenant, members, apps | ✓ | ✓ | ✓ | ✓ |
| Rename tenant | ✓ | ✓ | ||
| Delete tenant | ✓ | |||
| Invite, remove, change roles | ✓ | ✓ | ||
| Transfer ownership | ✓ | |||
| Create and configure apps, test store, test ads | ✓ | ✓ | ✓ | |
| Delete apps | ✓ | ✓ | ||
Issue refunds through a channel (refunds.write) |
✓ | ✓ | ||
| Rotate keys, write credentials, send test webhooks | ✓ | ✓ | ✓ | |
| Read audit log | ✓ | ✓ |
Tenants are created by Kasskeep. Only Kasskeep can change a tenant’s status, rate limit, quotas and data region.
A user who is not a member of a tenant gets 404 tenant_not_found, so tenant ids cannot be probed. A member without the permission gets 403 forbidden.
Personal access tokens
Section titled “Personal access tokens”The CLI and automation use personal access tokens (kkp_...). Create one from a signed-in session:
curl -X POST https://api.kasskeep.com/v1/admin/me/tokens \ -H "Authorization: Bearer kks_..." -H "Content-Type: application/json" \ -d '{"name": "ci", "expires_in_days": 90}'The token is shown once. Sessions (kks_...) last 12 hours. Tokens act with the permissions of the user who created them.
Audit log
Section titled “Audit log”Every admin action writes an audit record: tenant, actor, action, target, before and after values, and IP address. Fields such as keys, private keys, passwords and tokens are recorded as (redacted). Read it with GET /v1/admin/tenants/:tenant_id/audit.