Kudos CRM — Developer API
The Kudos CRM developer API. Three surfaces:
- Personal access tokens — mint and manage scoped bearer tokens (
pat_…) for the REST API. - Outbound webhooks — subscribe your own URL to CRM events (HMAC-signed, retried).
- Ingest — producers POST signed webhook events into the CRM, and read the manifest for schema compatibility.
Most endpoints authenticate with a bearer personal access token
(Authorization: Bearer pat_…). The ingest endpoints instead authenticate with an
HMAC signature over the request body (X-Kudos-Signature: t=<ts>,v1=<hex>) — see the
Webhook signing guide.
Try it sends a real request from your browser straight to the production
server — nothing is proxied — carrying whatever credential you enter under
Authorization. That credential is held in the tab's sessionStorage and
is discarded when you close the tab; it is never sent anywhere but the API.
Requests count against the same rate limits as any other caller, and writes
are real writes. To exercise a local or staging API instead, use your own
HTTP client — this hosted reference can only reach the host above.
Authentication
- HTTP: Bearer Auth
- API Key: HmacSignature
A personal access token, sent as Authorization: Bearer pat_…. Mint one under
Personal access tokens, or in-app at Settings → Security. Read-only when every
scope begins with read.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Bearer format: | pat |
HMAC-SHA256 over <unix_timestamp>.<raw_body> using the source's signing secret. Stripe-compatible header format. See the Webhook signing guide.
Security Scheme Type: | apiKey |
|---|---|
Header parameter name: | X-Kudos-Signature |
License