Cloud infrastructure
Identity, Tenant & Authorization
Sites, team roles, API tokens, OAuth for assistants, service accounts and the activity log.
Identity answers who is calling and what they may do. Every request is scoped to one site, and every token's permissions are limited by the role of the person or service account behind it.
Core objects
- Sites. The tenant boundary. Data never crosses between sites.
- Team members and roles. Owners, admins, editors and custom roles, with access requests.
- Tokens. Personal access tokens, OAuth access for assistants and service account tokens. See Authentication.
- Activity log. Every change made in the dashboard or through the APIs, with who made it.
How the APIs fit
GET /whoamishows what the current token can do.- List and create sites, read usage and the activity log with the Management API.
- What a customer may access belongs to Customers, Membership & Entitlements, not to identity.
What the APIs expose
- Site team RBAC (custom roles, access requests), personal access tokens, service accounts and OAuth 2.1 for the Management API, customer session tokensAvailable
- API
- PAT (
knr_pat_), OAuth 2.1 (knr_at_) with site scope;auth.whoami?websiteId=reports role vs. token scope; Customer Bearer (knr_cat_) bound to(websiteId, contactId) - Elements
<kanorio-login>- Hosted site
/settings/team,/settings/team/roles,/account/api-access- Webhooks
team.accessRequest.created
- Custom end-user application roles (e.g. teacher / TA / branch manager in your own app)Not offered
- Alternative
- Kanorio separates operational RBAC (site team), customer commercial entitlements (
Entitlement), and plan entitlements. Fine-grained custom app roles (e.g. "teacher can only view students in class B") are not offered as a platform primitive; enforce them in your own application backend or an authorization service such as OpenFGA.
- Enterprise SSO (SAML / OIDC / SCIM) & custom contractual uptime SLANot offered
- Alternative
- Kanorio provides Google OAuth, Passkeys (WebAuthn), TOTP 2FA, free team RBAC with system roles (
OWNER,ADMIN) plus up to 20 custom roles per site, and live platform status atstatus.kanorio.com. SAML/SCIM directory sync and custom SLA contracts are not offered.
API reference
Webhook events
- site.subscription.upcomingRenewal · Fired before an annual plan renews when annual add-ons or pending add-on / platform fees will be charged on the same invoice.
- site.subscription.addOnPriceChange · Fired at least 30 days before add-on prices change for the site, with the per-level price changes and effective date.
- team.accessRequest.created · Fired when a team member requests permissions they are missing, so people who manage the team can review it.
Recent changes
- 2026-10-28 Service account tokens (knr_sa_)
- 2026-10-24 Fine-grained scopes for publishing, domains, developer settings, media, orders and collection schemas
- 2026-10-23 Activity log redacts internal fields of platform actions
- 2026-10-14 OAuth client authentication, scope defaults and stability labels
For site owners
How to use this product in the dashboard is covered in the help center.
Open the help center