> For the complete documentation index, see [llms.txt](https://k4k3ru.gitbook.io/k4k3ru-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://k4k3ru.gitbook.io/k4k3ru-docs/getting-started/create-api-credential.md). # Create an API Credential Create an API credential for your K4K3RU account by requesting and submitting a one-time password (OTP). The credential provides the API key and secret key required to sign protected API requests. ## Prerequisites Before you begin, you need: * An active K4K3RU account. If you do not have one, follow [Sign Up with Email](/k4k3ru-docs/getting-started/sign-up-with-email.md). * Access to the inbox for the email address associated with the account. * An HTTP client such as `curl`. * A secure location, such as a secret manager, in which to store the returned secret key. The examples use `alex@example.com`. Replace it with the email address associated with your account in both requests. ## 1. Request an API Credential OTP Send `AccountAPI.RequestCredentialCreationOTP` to the K4K3RU API: ```bash curl --request POST 'https://api.k4k3ru.com/' \ --header 'Content-Type: application/json' \ --data '{ "id": "1", "method": "AccountAPI.RequestCredentialCreationOTP", "params": { "email": "alex@example.com" } }' ``` A successful response confirms the email address and tells you when the OTP expires: ```json { "id": "1", "result": { "purpose": "account.api.create_credential", "email": "alex@example.com", "expiresAt": "2026-08-20T12:20:00Z" } } ``` The `expiresAt` value above is an example. Use the expiration time returned by your request. Check the inbox for the email address you supplied and retrieve the OTP. For the complete RPC reference, see [Request an API Credential OTP by Email](/k4k3ru-docs/api/crm/request-api-credential-otp.md). ## 2. Choose a Signing Algorithm and Lifetime K4K3RU supports two signing algorithms: | Value | Description | | ------------- | -------------------------------------------------------------------------------------------------------- | | `hmac-sha256` | Uses a shared secret to generate request signatures. The next getting-started guide uses this algorithm. | | `ed25519` | Uses an Ed25519 private key to generate request signatures. | Choose one of the supported credential lifetimes: `7d`, `30d`, `180d`, or `365d`. The following example creates an HMAC-SHA256 credential that expires after 30 days. ## 3. Create the API Credential Submit the OTP with `AccountAPI.CreateCredential`. Replace `` with the code from the email: ```bash curl --request POST 'https://api.k4k3ru.com/' \ --header 'Content-Type: application/json' \ --data '{ "id": "2", "method": "AccountAPI.CreateCredential", "params": { "email": "alex@example.com", "code": "", "apiName": "getting-started", "signatureAlgorithm": "hmac-sha256", "expiresIn": "30d" } }' ``` A successful response returns the API credential: ```json { "id": "2", "result": { "accountId": "1786180518874776239", "apiName": "getting-started", "apiKey": "", "signatureAlgorithm": "hmac-sha256", "secretKey": "", "expiresAt": "2026-09-19T12:15:00Z" } } ``` The identifiers, keys, and expiration time above are placeholders or examples. Use the values returned by your request. For the complete RPC reference, see [Create an API Credential with an Email OTP](/k4k3ru-docs/api/crm/create-api-credential-with-email-otp.md). ## 4. Store the Credential Securely Store these response values: * `apiKey`: Public identifier included in authenticated API requests. * `secretKey`: Secret signing key encoded as unpadded Base64 URL. * `signatureAlgorithm`: Algorithm that must be used with this credential. * `expiresAt`: Time at which the credential expires. Treat `secretKey` as a secret immediately. Store it in a secret manager and never commit it to source control, embed it in browser-side code, send it to another service, or write it to application logs. ## Troubleshooting If a request returns an error, use its `error.code` to determine the next action: | Code | What to do | | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | `invalid_parameter` | Confirm the email, request fields, signing algorithm, and credential lifetime. The email must belong to an existing K4K3RU account. | | `unexpected` | Request a new API credential OTP and retry. If the error continues, report the RPC method and request time without including the OTP or secret key. | Do not publish, commit, or log an OTP or secret key while troubleshooting. ## Next Step Continue with [Make Your First Authenticated API Request](/k4k3ru-docs/getting-started/make-first-authenticated-request.md) to use the HMAC-SHA256 credential created in this guide. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://k4k3ru.gitbook.io/k4k3ru-docs/getting-started/create-api-credential.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.