How do I authenticate Kora API requests? Headers and keys
Updated Oct 21, 2026
The public API authenticates with two headers on every request: X-Workspace-ID (your ws_… identifier) and X-Secret-Key (from Settings → API Access). Treat the secret like a password — it grants full workspace access via the API. If it leaks, regenerate it from the same screen; the old key stops working immediately.
Example
curl https://api.usekora.app/public/v1/tickets \
-H "X-Workspace-ID: ws_YOURID" \
-H "X-Secret-Key: kora_sk_YOURKEY"Limits
Requests are rate-limited per workspace (50,000/day while your wallet holds credits) and every 400 responses meters 1 credit. Responses include X-RateLimit headers so integrations can back off gracefully.
Common questions
What if my secret key leaks?
Regenerate it in Settings → API Access. The old key stops working immediately.
What are the rate limits?
Per workspace, 50,000 requests a day while your wallet holds credits and 5,000 a day when it is empty. Responses carry X-RateLimit headers.
Does API usage cost credits?
Every 400 API responses meters 1 credit. Creating a ticket through the API costs 1 credit like any other ticket.