curl -X POST https://kymaapi.com/v1/auth/register \
-H "Content-Type: application/json" \
-d '{"email": "you@email.com", "password": "your_password"}'
Endpoints
Register
Create a new account and get an API key.
POST
/
v1
/
auth
/
register
curl -X POST https://kymaapi.com/v1/auth/register \
-H "Content-Type: application/json" \
-d '{"email": "you@email.com", "password": "your_password"}'
The new API key starts with a 0balance.Weemailyouaverificationlink,andopeningitaddsthe0.50 signup credit, which spends on the
free tier. Until then, a call to any model answers
402.
string
required
Your email address.
string
required
Password (min 6 characters).
string
Optional referral code from the person who invited you.
Response
{
"user_id": "abc123",
"api_key": "kyma-your-new-api-key",
"session_token": "ks-your-session-token"
}
Errors
Errors have the shape{"error": {"message", "type", "code"}}, where code is the HTTP status.
| Status | error.type | When |
|---|---|---|
400 | invalid_request | Invalid JSON, a missing or malformed email, a password under 6 characters, or an address that cannot receive mail (“Email address could not be verified. Use a real inbox.”) |
409 | account_exists | An account with this email already exists. Sign in instead. |
429 | rate_limited | Too many sign-ups from your network. Try again later. |
429 | signup_paused | Email sign-ups are paused for a short while. Sign up with Google, or try again in an hour. |
Session cookie
When the browser session cookie is enabled, a successful response also carries twoSet-Cookie headers. They are additional to the JSON body, which is
unchanged — session_token is still the credential to store and send as
Authorization: Bearer ….
Set-Cookie: __Host-kyma_session=ks-…; Path=/; Max-Age=2592000; Secure; HttpOnly; SameSite=Lax
Set-Cookie: kyma_csrf=…; Path=/; Max-Age=2592000; Secure; SameSite=Lax
__Host-kyma_session is host-only and HttpOnly: it is sent by the browser to
kymaapi.com only, and page scripts cannot read it. kyma_csrf is readable, and
a request authenticated by the cookie alone must echo it in an X-Kyma-CSRF
header on any POST, PUT, PATCH or DELETE; requests that send a Bearer
token need nothing extra. POST /v1/auth/logout clears both.
API clients that do not keep a cookie jar are unaffected — ignore the headers and
use the Bearer token as before.
curl -X POST https://kymaapi.com/v1/auth/register \
-H "Content-Type: application/json" \
-d '{"email": "you@email.com", "password": "your_password"}'