Base URL and authentication

All routes are under /v1, with one exception: /mcp (the MCP server, see below) is the only route outside /v1. The service speaks JSON only (application/json; charset=utf-8), except the PDF attestation route which returns application/pdf.

Every route except GET /v1/health requires an API key:

Authorization: Bearer ak_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

A missing or malformed header, or an unknown/revoked key, returns 401 UNAUTHORIZED. Keys are created and revoked from the dashboard (API keys) or the akwito admin CLI; a key is either live (ak_live_…) or test (ak_test_…, see Test keys). They are shown once at creation time and stored hashed server-side.

A suspended account gets 401 UNAUTHORIZED on every API route and cannot open a dashboard session either.

No email is ever sent. A forgotten password is reset by an administrator, from the admin pages or with akwito admin set-password.