> For the complete documentation index, see [llms.txt](https://docs.khotan.com/llms.txt). A markdown version of any page is available at its `index.md` URL.

# Quickstart

Khotan's HTTP API is the surface the CLI wraps. Anything the CLI can do, you can do over HTTP — and you do not need the CLI, an SDK, or a package manager to start. This page assumes only `curl`.

## 1. Get a key

Exchange your account credentials for an organization-scoped API key. The organization is named explicitly because you may belong to several and there is no session to infer one from.

```bash
curl -X POST https://app.khotan.com/api/v1/api-keys \
  -H "Content-Type: application/json" \
  -d '{
    "email": "you@example.com",
    "password": "your-password",
    "organizationId": "org_...",
    "name": "local-dev"
  }'
```

The response carries the key once:

```json
{
  "key": "mk_live_...",
  "id": "...",
  "organizationId": "org_...",
  "role": "owner",
  "expiresAt": null
}
```

Store it now — the secret is never retrievable again. Put it in an environment variable rather than a file you might commit:

```bash
export KHOTAN_API_KEY="mk_live_..."
```

This endpoint is rate limited to 5 requests per minute per IP and email, and it fails closed. If you are scripting against it, cache the key rather than minting one per run.

## 2. Confirm which organization you are talking to

```bash
curl https://app.khotan.com/api/v1/me \
  -H "Authorization: Bearer $KHOTAN_API_KEY"
```

```json
{ "organizationId": "org_...", "role": "owner", "keyId": "..." }
```

Do this first in any automation. A key carries its own organization, so this is the only way to be certain which workspace your script is about to change.

## 3. Make a real call

```bash
curl https://app.khotan.com/api/v1/apps \
  -H "Authorization: Bearer $KHOTAN_API_KEY"
```

Every resource follows the same shape. Browse them under [HTTP API](/api/), or generate a client from the [OpenAPI document](https://docs.khotan.com/openapi.json) instead of writing requests by hand.

## The base URL never changes

`https://app.khotan.com` is the base URL for every account and every workspace. There is no per-workspace API host: the key carries its organization, and no operation reads the request host. If you have seen a workspace subdomain in a browser, that is browser tenancy — it is not how the API is addressed.

## What to read next

- [Authentication](/api/auth/) — key scoping, rotation, and revocation.
- [Conventions](/api/conventions/) — errors, retries, rate limits, and pagination.
- [HTTP API](/api/) — the generated per-resource reference.