API Keys and Embed Access

API keys allow external systems to access KinoForms data.

Open Settings > API Keys.

Create an API Key

1. Open Settings > API Keys.
2. Choose Create API Key.
3. Enter a key name.
4. Select one or more permissions.
5. Create the key.
6. Copy the key immediately.

The full key is only shown once.

API Key Permissions

Available scopes:

• forms:read: view form definitions
• forms:write: create and modify forms
• submissions:read: view submission data
• submissions:write: create submissions

Grant the smallest scope set needed by the integration.

Revoke an API Key

1. Open Settings > API Keys.
2. Find the key.
3. Choose revoke or delete.
4. Confirm.

Revocation is permanent. External systems using the key will stop working.

Embed Routes

Embed/API-key routes are intended for external systems that need to:

• Fetch a form definition
• Submit data to a form
• Read submissions

Send the API key with requests using the expected API-key header configured by the application.

Key Safety

• Do not put secret API keys in public frontend code.
• Store keys in server-side environment variables or secret managers.
• Rotate keys if they are exposed.
• Revoke unused keys.