Account

Website session cookie is kv_session. API clients should use Bearer. Register returns an kv_… key once.

Accounts

Register·Reset password·POST /v1/auth/registerneedsaccepted_terms: trueand returnsapi_keyonce.

POST /v1/auth/login ·POST /v1/auth/logout ·GET /v1/auth/me ·POST /v1/auth/forgot-password ·POST /v1/auth/reset-password ·POST /v1/auth/claim-account

curl -X POST https://kasva.dev/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","password":"at-least-8","accepted_terms":true}'

Rotate API key

POST /v1/auth/rotate-key

curl -X POST https://kasva.dev/v1/auth/rotate-key \
  -H "Authorization: Bearer YOUR_KASVA_KEY"

Credits and Pro

Hosted open models debit credits. BYOK is measured, not debited.GET /v1/credits ·GET /v1/credits/history ·POST /v1/credits/checkout ·POST /v1/billing/pro

Named extra keys: GET/POST /v1/auth/keys. Legacy one-shot: POST /v1/keys.