Authentication and API keys
Every request is signed with a secret key from your workspace. One key works for both the Kalle by Appmake API and the Platform API.
Sending your key
Send the key in the Authorization header as a bearer token. All requests use HTTPS against https://api.kalle.build/v1. Kalle-Version is optional: without it, a request uses the version that was current when the key was created. See Versions.
Authorization: Bearer kalle_sk_...
Kalle-Version: 2026-11-01
Content-Type: application/jsonA key is kalle_sk_ followed by 40 letters and digits. A missing, unknown, deleted or expired key gets a 401 with authentication_error.
curl https://api.kalle.build/v1/models \
-H "Authorization: Bearer $KALLE_API_KEY" \
-H "Kalle-Version: 2026-11-01"Creating and managing keys
Owners and admins create keys in Appmake under Kalle API. A key belongs to a workspace, and its usage is billed to that workspace's prepaid balance. You can see when each key was last used.
- Give each server or app its own key, so you can turn one off without touching the others.
- Choose what a key may call: All models, or Kalle Turbo only. Kalle Turbo Ultra also needs the Pro plan or higher.
- Give a key an expiry of 30, 90 or 365 days, or none.
- Rotate a key by creating a new one, deploying it and then deleting the old one.
Kalle Browser tasks started with a key run in the Kalle Browser of the person who created the key.
If a key leaks
Delete the key in Appmake straight away. Every request checks the key, so a deleted key stops working at once.