Kynver API Keys: Agent Keys and User Keys

API & MCP3 min read

Kynver API keys let your agent or your development tools authenticate with the Kynver API and MCP server without requiring you to sign in each time. They prove that an action — like starting verification or submitting the ownership challenge — is authorized to act on behalf of your agent.

Two Types of Keys

Kynver has two kinds of API keys, used in different contexts:

Agent API keys — scoped to a specific agent. Used by the MCP server write tools (verify_ownership, start_kyc, submit_questionnaire, get_tracking_setup) and by the SDK's KynverTracker. Created in Dashboard → your agent → Settings → API Keys.
User API keys — scoped to your Kynver account. Used for direct REST API calls with an Authorization: Bearer header. Created in Account → Settings → API Keys.

If you are connecting the Kynver MCP server to Cursor or Claude Desktop, you need an agent API key for the specific agent you want to manage.

Creating an Agent Key

Step 1 —

Go to Dashboard → your agent → Settings tab.

Step 2 —

Find the API Keys section and click Create key.

Step 3 —

Give it a name that tells you where it is used — for example "Cursor MCP" or "CI pipeline". Naming keys makes it easy to revoke one specific key later without affecting others.

Step 4 —

Copy the key immediately. The full secret is only shown once. Kynver stores only a hash — there is no way to retrieve it again.

Step 5 —

Paste it into your MCP config or .env file.

Creating a User Key

Go to Account → Settings → API Keys → Create key. Give it a name, copy the secret immediately, and use it in the Authorization: Bearer header for REST API requests.

Using an Agent Key with the MCP Server

Set KYNVER_API_KEY in your MCP server config's env block:

{
  "mcpServers": {
    "kynver": {
      "command": "npx",
      "args": ["-y", "@kynver-app/mcp-server"],
      "env": {
        "KYNVER_API_KEY": "kyn_xxxxxxxxxxxxxxxxxxxxxxxx"
      }
    }
  }
}

Read-only tools (resolve_agent, list_agents, get_verification_status) and register_agent work without a key. Write tools that take actions on your agent (starting KYC, submitting the questionnaire, doing the ownership challenge) require one.

Security Rules

Following these rules keeps your key and your agent safe:

Never commit keys to source code. Use .env files and make sure .env is in your .gitignore.
Never paste keys into chat messages or tool input fields. For the MCP server, the key must be in the env config block — not typed into a conversation.
Create one key per use case. If a key is compromised, you can delete it without disrupting anything else.
Delete keys you no longer need. Old unused keys are unnecessary risk.

Identifying Your Keys

The dashboard shows the first 8 characters of each key (the prefix, e.g. kyn_a1b2) so you can tell keys apart without exposing the full secret. The lastUsedAt field shows when each key was last active.

Revoking a Key

Agent keys: Dashboard → your agent → Settings → API Keys → Delete. User keys: Account → Settings → API Keys → Delete.

Deletion is immediate. Any request using the deleted key immediately starts receiving 401 errors. If a key has been compromised, delete it immediately and create a replacement.