What can I do with the Kohala API?

Render Koans, manage Agents, drive subscriptions, and embed Living visualizations programmatically. The API is REST plus webhooks, OpenAPI-documented (GET /api/v1/openapi.json), and metered with the same token system as the rest of the platform.

How do I authenticate to the Kohala API?

Three ways: session cookies for browser clients, pk_ API keys for server-to-server agent management under /api/v1/agents, and mk_ mobile application tokens for native mobile apps. Every call is metered against your credit balance, and the API documentation lists every endpoint, request shape, and webhook event.

Does Kohala have a mobile API?

Yes. Every Kohala account can mint long-lived mobile application tokens (mk_ bearer tokens, no cookies) for native apps. A mobile token can chat with Lani, read and act on Canvas activity and approvals, view reports and Koans (including WebView render routes), and check the account's credit balance. Tokens are minted via POST /api/mobile/login or from the Profile → Developer tab, are shown once, and can be revoked per device at any time.

Can my app attach documents and images to Lani chat?

Yes. Upload a file (JPEG, PNG, WebP, HEIC, PDF, TXT, CSV, DOCX, or XLSX, up to 20 MB) to POST /api/lani-meta/attachments, then pass the returned attachment ids in the message send. Kohala extracts the content server-side — documents become text, images go through a vision model — so Lani can read and discuss the file on that turn and every later one, with no client-side OCR. Attachments are private to the uploading user, validated by file content rather than extension, and unattached uploads are cleaned up after 24 hours.

How secure are Kohala mobile tokens?

Mobile tokens are hashed at rest and scoped to an explicit allowlist of mobile surfaces — everything else returns 403. Every request re-verifies the owning account still exists and is verified, so revoking a token or deactivating the account cuts off access immediately. Token management (list, mint, revoke) is session-only, so a leaked device token cannot mint or enumerate other tokens.

Kohala API — render, embed & extend Koans programmatically

The Kohala public API. Render Koans, manage Agents, drive subscriptions, and embed Living visualizations anywhere — programmatically. Token-metered, REST + webhooks, OpenAPI documented (spec at kohala.ai/api/v1/openapi.json).

Frequently Asked Questions

What can I do with the Kohala API?: Render Koans, manage Agents, drive subscriptions, and embed Living visualizations programmatically. The API is REST plus webhooks, OpenAPI-documented (GET /api/v1/openapi.json), and metered with the same token system as the rest of the platform.
How do I authenticate to the Kohala API?: Three ways: session cookies for browser clients, pk_ API keys for server-to-server agent management under /api/v1/agents, and mk_ mobile application tokens for native mobile apps. Every call is metered against your credit balance, and the API documentation lists every endpoint, request shape, and webhook event.
Does Kohala have a mobile API?: Yes. Every Kohala account can mint long-lived mobile application tokens (mk_ bearer tokens, no cookies) for native apps. A mobile token can chat with Lani, read and act on Canvas activity and approvals, view reports and Koans (including WebView render routes), and check the account's credit balance. Tokens are minted via POST /api/mobile/login or from the Profile → Developer tab, are shown once, and can be revoked per device at any time.
Can my app attach documents and images to Lani chat?: Yes. Upload a file (JPEG, PNG, WebP, HEIC, PDF, TXT, CSV, DOCX, or XLSX, up to 20 MB) to POST /api/lani-meta/attachments, then pass the returned attachment ids in the message send. Kohala extracts the content server-side — documents become text, images go through a vision model — so Lani can read and discuss the file on that turn and every later one, with no client-side OCR. Attachments are private to the uploading user, validated by file content rather than extension, and unattached uploads are cleaned up after 24 hours.
How secure are Kohala mobile tokens?: Mobile tokens are hashed at rest and scoped to an explicit allowlist of mobile surfaces — everything else returns 403. Every request re-verifies the owning account still exists and is verified, so revoking a token or deactivating the account cuts off access immediately. Token management (list, mint, revoke) is session-only, so a leaked device token cannot mint or enumerate other tokens.