Authenticate

Learn how to ensure secure access to Kobo API Resources.

Overview

The Kobo API uses standard HTTP Basic Authentication to authenticate requests. You do not need to manage access tokens or refresh tokens. Instead, you authenticate each request directly using your API credentials obtained from the API Keys page.

• Username: Your Public Key (e.g., kobo_live_pk_... or kobo_test_pk_...)
• Password: Your Secret Key (e.g., kobo_live_sk_... or kobo_test_sk_...)

Making Authenticated Requests

To authenticate, provide your API credentials in the Authorization header of your HTTP requests using the Basic auth scheme.

If you are using tools like curl, you can simply pass the -u flag with your Public Key and Secret Key separated by a colon:

curl --request POST \
  --url https://api.kobo.triumphsystems.tech/v1/identities \
  --user 'kobo_test_pk_12345:kobo_test_sk_67890' \
  --header 'Content-Type: application/json' \
  --data '{
    "external_reference": "user_123",
    "display_name": "John Doe"
  }'

Behind the scenes, this creates an Authorization: Basic <base64-encoded-credentials> header.

Environments (Test vs Live)

The Kobo API environment you are interacting with is strictly determined by the prefix of the keys you use:

• Live Keys (kobo_live_): Will hit the production database and process real data and billing.
• Test Keys (kobo_test_): Will process requests in a sandbox environment and simulate behavior without affecting live data.

Important: You must use matching keys for the environment. Sending a kobo_live_ public key with a kobo_test_ secret key will result in an immediate 401 Unauthorized error.

Security Best Practices

• Never expose your Secret Key: Your Secret Key can bypass all application security and perform sensitive operations. It must never be embedded in client-side code (browsers, mobile apps) or committed to public repositories.
• Rotate compromised keys immediately: If you suspect a key has been compromised, generate new credentials immediately in the Kobo Console and replace the old ones in your application.
• Public Key visibility: The Public Key (pk_) acts as your identifier. While it is generally safe to use as an identifier, it should still be treated with care.