Personal access tokens

Personal access tokens (kfx_…) authenticate you as a platform user. They can call console APIs and the data API (rules are bypassed on the data API).

Create them in the console: Settings → Developers → API keys. The secret is shown once.

REST:

Method	Path
GET	/api/auth/api-keys
POST	/api/auth/api-keys
DELETE	/api/auth/api-keys/:keyId

Send as Authorization: Bearer kfx_….

Use PATs for:

• MCP (KATAFLAX_TOKEN)
• Admin SDK setToken
• CI that must manage schemas or hosting

Do not use a PAT in an end-user app. Use project auth. Do not confuse PATs with service tokens (kfxs_…).