KhotanalphaMarkdown

Quickstart

Khotan's HTTP API is the surface the CLI wraps. Anything the CLI can do, you can do over HTTP — and you do not need the CLI, an SDK, or a package manager to start. This page assumes only curl.

1. Get a key

Exchange your account credentials for an organization-scoped API key. The organization is named explicitly because you may belong to several and there is no session to infer one from.

curl -X POST https://app.khotan.com/api/v1/api-keys \
  -H "Content-Type: application/json" \
  -d '{
    "email": "you@example.com",
    "password": "your-password",
    "organizationId": "org_...",
    "name": "local-dev"
  }'

The response carries the key once:

{
  "key": "mk_live_...",
  "id": "...",
  "organizationId": "org_...",
  "role": "owner",
  "expiresAt": null
}

Store it now — the secret is never retrievable again. Put it in an environment variable rather than a file you might commit:

export KHOTAN_API_KEY="mk_live_..."

This endpoint is rate limited to 5 requests per minute per IP and email, and it fails closed. If you are scripting against it, cache the key rather than minting one per run.

2. Confirm which organization you are talking to

curl https://app.khotan.com/api/v1/me \
  -H "Authorization: Bearer $KHOTAN_API_KEY"
{ "organizationId": "org_...", "role": "owner", "keyId": "..." }

Do this first in any automation. A key carries its own organization, so this is the only way to be certain which workspace your script is about to change.

3. Make a real call

curl https://app.khotan.com/api/v1/apps \
  -H "Authorization: Bearer $KHOTAN_API_KEY"

Every resource follows the same shape. Browse them under HTTP API, or generate a client from the OpenAPI document instead of writing requests by hand.

The base URL never changes

https://app.khotan.com is the base URL for every account and every workspace. There is no per-workspace API host: the key carries its organization, and no operation reads the request host. If you have seen a workspace subdomain in a browser, that is browser tenancy — it is not how the API is addressed.