An API key is a unique password starting with knr_pat_ that represents "you, but only with the permissions you've granted and only for the websites you've specified." Once you add the key to your AI tools or automation scripts, they can list your websites, edit pages, upload images, publish content, or bind domains in the background—without you needing to log in via a browser.
Manage your keys in "Account Settings › API Access".
You don't need an API key for ChatGPT, Claude, Gemini, Zapier, or Make: These tools have built-in connectors. Simply paste the MCP server URL
https://app.kanorio.com/api/mcpand click "Allow" on the Kanorio authorization page (see Authorized Apps for details). Even if you select these tools while creating a key, the system will provide the server URL directly instead of generating a key.
Log in, click your avatar in the top right, and go to "Account Settings" → "API Access" (or visit app.kanorio.com/account/api-access directly), then click "Create Key".
Click the icon of the tool you want to use:
By default, the system fills in "{Tool Name} Assistant," which you can modify. Only you can see this name. We recommend the "one tool, one purpose, one key" naming principle, such as "Cursor - Brand Website" or "n8n - Daily Inventory Sync." This makes it easy to identify which key to revoke if a tool is retired or a team member leaves.
Choose from three preset plans without needing to manage individual permissions:
| Permission Plan | Capabilities | Use Case |
|---|---|---|
| View Only | Read website settings, pages, blog posts, Collections, online form responses, customer lists, segments, products, orders, and analytics. Cannot modify any content. | Let AI help organize operational reports, check website structure, or use with the Content Delivery API for ?preview=1 draft previews. |
| Edit Content (Default) | Includes "View Only" plus adding and editing page module drafts, headers and footers, uploading and managing images, and writing blog posts. Cannot publish or unpublish the website. (To allow AI to create and write to Collections, click "Custom" and check "Content › Manage Collections" or select "Full Access".) | Let AI help edit pages, swap images, and write posts daily, with you reviewing and publishing manually. |
| Full Access | Grants all permissions available for AI/API, including publishing and unpublishing the website, binding a custom domain, creating and managing Collections, setting CORS allowed origins, adding and editing products, managing customer tags, and creating newsletter drafts. | Fully automated site building to go-live, AI-driven database creation, or integrating custom backends with ERP systems. |
To fine-tune permissions, click "Custom" to expand the 6 permission groups (Page Browsing, Website Settings, Content, E-commerce, Customers, Marketing). You can select "Select All" for each group. When you select write-access permissions (e.g., "Edit Website Content"), the system automatically checks the necessary read-access permissions (e.g., "Access Dashboard" and "Access Website Editor") and marks them as "Automatically Included" to ensure the tool functions correctly.
Security Restrictions:
- Even with "Marketing" send permissions or "Full Management," AI and APIs can only create and edit newsletter drafts; they cannot send or schedule newsletters directly (you must confirm in the dashboard before sending).
- High-risk permissions—such as exporting website/order/customer/marketing/analytics data, downloading form attachments, processing refunds, deleting contacts, changing website currency, managing members, handling billing, and website transfers—are not available for selection.
Choose 7 days, 30 days, 90 days (default), or 365 days. The expiry date is displayed next to the option (for security reasons, we do not offer keys that never expire):
Creating an API key is equivalent to granting external programs access to your account. If you have been logged in on this device for more than 15 minutes, the system will require you to verify your identity again:
The plain-text key (knr_pat_...) is only displayed once on the completion screen. Below the key, the system provides a configuration snippet pre-filled with your key and server URL based on the tool you selected:
.cursor/mcp.jsonclaude mcp add command to paste directly into your terminal.vscode/mcp.jsonAuthorization: Bearer headerClick "Copy Configuration" to paste it into your tool. If you close the window without copying, the system will prompt you to confirm. After closing, the list will only show the first 8 characters for identification. If you forget the key, simply perform a "Rotation."
The actual permissions for a key on a specific website are the intersection of the "permissions selected for the key" and "your member role on that website":
$$\text{Actual Permissions} = \text{Key Permissions} \cap \text{Your Member Role Permissions}$$
In the "Account Settings › API Access" list, each key displays:
Tool: {client}): The system records the name of the program that last connected with this key (e.g., cursor-vscode, claude-code, or kanorio-cli). If you created a key for Cursor but see an unfamiliar tool name, the key may have been leaked—rotate or revoke it immediately.Each Kanorio account can have up to 20 active keys at once (keys in the rotation buffer do not count toward this limit).
Click the "More (⋯)" menu next to a key and select "Edit" to modify the name, accessible websites, and permission plan (expiry dates cannot be modified directly; use "Rotate" to extend).
When you receive an expiry reminder, want to update your password periodically, or suspect a leak, you don't need to delete the old key and fill out the form again. Click the "More (⋯)" menu and select "Rotate":
During the 1-hour or 24-hour buffer, the list displays both keys, with the old key marked as "Expires in {time}." Buffer-period keys can only be revoked and will not trigger further expiry reminders. Once the buffer passes, the old key is automatically invalidated.
Expired keys: If a key has already expired, the menu shows "Regenerate"—this also applies the original name, websites, and permissions to a new key (no buffer option is available since the old key is already invalid).
Click "Revoke" in the "More (⋯)" menu and confirm. The key will be permanently invalidated immediately. The AI assistant or program using it will receive a 401 UNAUTHORIZED error on its next request (drafts saved before revocation are preserved).
.cursor/mcp.json files (ensure they are added to .gitignore).knr_pat_ key directly into the message, do not do it.No, the maximum expiry is 365 days. Regular rotation significantly reduces the risk of long-term credential leaks. You will receive email reminders 7 days and 1 day before expiry; simply click "Rotate" to issue a new key using the original settings in seconds.
No. Each API key is bound to the creator's account and audit logs. If a team member needs to use Cursor or automation tools, they must log in to their own Kanorio account to create a key. The key's permissions will automatically be limited by their role on the website.
Because these actions are equivalent to issuing or expanding a long-term pass that represents your authority to operate the website. To prevent others from creating keys while your computer is unlocked or via an old login session, the system requires 2FA/Passkey verification or re-login if it has been more than 15 minutes since your last login. Conversely, "Reducing permissions," "Modifying names," and "Revoking keys" are security-convergent actions that take effect immediately without verification.
Reminders are sent to the email address associated with your Kanorio account and synced to the inbox notification in the top right of the dashboard. Please check your spam folder. Additionally, if the key has already expired, been revoked, or been rotated, or if you selected a 7-day expiry (which only triggers a reminder 1 day before), the system will not send reminders for those stages.