Authentication
Two kinds of credentials, both sent as a Bearer token and both scoped to one workspace (an organization in the API).
API keys — servers, CI and n8n
Create one on the API page in the app (owners and admins). The secret is shown once; we store only an HMAC. Keys act for the workspace and are limited by its plan.
Authorization: Bearer kt_live_YOUR_KEYSign in with the app — MCP clients and the CLI
OAuth 2.1: authorization code with PKCE (S256), dynamic client registration and client ID metadata documents, rotating refresh tokens. The person signs in, picks the workspace and approves the permissions. A new account sets its workspace up first (an artist's or a label's, and a plan), then comes back to approve. Access tokens last an hour; clients refresh them on their own.
Connected apps are listed on the API page, where each can be disconnected. Access stops within 30 seconds.
Scopes
| Scope | Allows |
|---|---|
videos:read | See videos, quotes and your credit balance |
videos:write | Quote, create, cancel, retry and delete videos (spends credits) |
music:read | See artists, their photos and songs |
music:write | Add, rename and archive artists and songs, upload songs and artist photos |
library:read | Browse Looks |
library:write | Rename, delete and publish your Looks |
organizations:read | See the workspaces you belong to |
organizations:write | Create workspaces you own, and rename or switch the type of one you own or run |
OAuth endpoints
| Authorization server | https://kinetune.com/.well-known/oauth-authorization-server |
| MCP resource | https://kinetune.com/mcp · metadata at /.well-known/oauth-protected-resource/mcp |
| REST resource | https://kinetune.com/api/v1 · metadata at /.well-known/oauth-protected-resource/api/v1 |
| Authorize · token | /api/auth/oauth2/authorize · /api/auth/oauth2/token |
| Register · revoke | /api/auth/oauth2/register · /api/auth/oauth2/revoke |
Send resource (RFC 8707) with the MCP or REST URL so the token's audience matches; unauthenticated calls answer 401 with a WWW-Authenticate header that points to the resource metadata.