| title | Authenticating to Kosli |
|---|---|
| description | How to get an API token for the Kosli CLI and API, and where to manage credentials. |
| icon | key |
Most interactions with Kosli — from the CLI, the API, or CI/CD pipelines — require an API token. This page covers the quickest path to getting one and points to the deeper documentation for each topic.
| Use case | Credential | Where to manage it |
|---|---|---|
| CI/CD, runtime reporters, automation | Service account API key (recommended) | Service accounts |
| Interactive scripts tied to your user | Personal API key | Personal API keys |
- EU: [app.kosli.com](https://app.kosli.com)
- US: [app.us.kosli.com](https://app.us.kosli.com)
Depending on how your organization is set up, you'll sign in with single sign-on, [Magic Link](/administration/authentication/magic_link) or [GitHub](/administration/authentication/github_login).
Pass the token as a bearer token when calling the API directly:
curl -H "Authorization: Bearer <<your-api-key>>" \
https://app.kosli.com/api/v2/environments/<<your-org-name>>For CLI usage, basic auth, and full examples, see API authentication methods.
- Single sign-on — configure sign-in through your identity provider.
- Magic Link — sign in with an emailed link, without an identity provider.
- GitHub sign-in — sign in with a GitHub account, including GitHub IP allow lists.
- Service accounts — admin lifecycle for machine credentials.
- API key rotation — how rotation works, with a step-by-step tutorial.
- Roles in Kosli — what users and service accounts can do at each role.