API reference

Authentication headers

• Publishable key — x-kembo-publishable-key: pk_… on project and some public routes.
• Bearer token — Authorization: Bearer <access_token> for end-user routes.
• Secret key — server-only routes that list or manage users on behalf of the project. An end-user access token works too, but only if the project owner promoted that user to the admin role; otherwise listing/deleting other users is forbidden.
• Analytics device id — x-kembo-analytics-device optional header with a random UUID per install for visitor counting.

Project

GET /api/v1/project

Returns public project configuration for the publishable key: branding, enabled auth providers, analyticsEnabled, and related flags. Called by the SDK on startup.

GET /api/v1/project
x-kembo-publishable-key: pk_your_key

Auth (end user)

POST /api/v1/auth/google

Exchange a Google ID token for Kembo session tokens.

POST /api/v1/auth/apple

Exchange an Apple identity token (and optional name/email) for session tokens.

POST /api/v1/auth/refresh

Rotate refresh token and issue a new access token.

POST /api/v1/auth/signout

Revoke the current refresh token.

GET /api/v1/auth/me

Return the current end user for a valid access token.

Analytics

POST /api/v1/analytics/events

Ingest one or more events when analytics is enabled for the project. Requires publishable key. Events include name, platform, optional path, and timestamp.

POST /api/v1/analytics/events
x-kembo-publishable-key: pk_your_key
x-kembo-analytics-device: <uuid-per-install>
Content-Type: application/json

{
  "events": [
    { "name": "screen_view", "platform": "ios", "path": "/home" }
  ]
}

SDK distribution

Platform SDKs are served from /api/v1/sdk/{platform} routes (init, install, bundle, and file endpoints). The dashboard setup guide runs the correct init command for your stack — you rarely call these manually.

Dashboard API

Routes under /api/projects require a dashboard session cookie. They power the developer UI (create project, enable analytics, OAuth credentials, billing, etc.) and are not intended for mobile apps.

Errors

JSON error responses include an error message string. Typical status codes: 401 unauthorized, 403 forbidden, 404 not found, 409 conflict, 422 validation error.

Related guides

• Authentication
• Analytics
• Getting started