Authentication

All requests to the Keme API must be authenticated. Keme uses a two-step authentication model: you present a long-lived API key to obtain a short-lived JWT access token, then pass that token in the Authorization header of every subsequent API call.

Access tokens expire after 3600 seconds (1 hour). Your server-side code should cache the token and refresh it proactively before expiry to avoid unnecessary latency spikes.

API Key Types

Keme issues two distinct categories of API key. Choose the correct type for your integration — mixing them up is the most common source of authentication errors.

Endpoints

1curl -X POST https://api.kemegames.com/v1/auth/token \
2  -H "Content-Type: application/json" \
3  -d '{
4    "apiKey": "sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
5    "organizationId": "org_01HX9KBCDE3F4G5H6J7K8L9M0N"
6  }'

1{
2  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJrZXlfMDFIWDlLQkNERTNGNEc1SDZKBUsyTDlNME4iLCJvcmciOiJvcmdfMDFIWDlLQkNERTNGNEc1SDZKBUsyTDlNME4iLCJzY29wZXMiOlsidGlja2V0czpyZWFkIiwidGlja2V0czp3cml0ZSJdLCJpYXQiOjE3NTAwMDAwMDAsImV4cCI6MTc1MDAwMzYwMH0.exampleSignature",
3  "expiresIn": 3600,
4  "tokenType": "Bearer"
5}

1{
2  "id": "key_01HX9KBCDE3F4G5H6J7K8L9M0N",
3  "organizationId": "org_01HX9KBCDE3F4G5H6J7K8L9M0N",
4  "name": "Production Server Key",
5  "type": "server",
6  "scopes": [
7    "tickets:read",
8    "tickets:write",
9    "players:read",
10    "analytics:read"
11  ],
12  "lastUsedAt": "2026-06-15T08: 42: 00Z",
13  "createdAt": "2026-01-01T00: 00: 00Z"
14}

Using the Access Token

Pass the accessToken returned from POST /v1/auth/token in the Authorization header of every API request using the Bearer scheme:

1curl https://api.kemegames.com/v1/tickets \
2  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
3  -H "Content-Type: application/json"

Tokens are stateless JWTs signed with RS256. The API validates the signature and expiry on every request — no server-side session lookup is required, which means token validation adds negligible latency.

Scopes

Every API key is provisioned with an explicit set of scopes that determine which API resources and actions it can access. Attempting an operation that requires a scope not granted to your key returns 403 Forbidden.

Scopes follow a resource:action naming convention. Grant only the minimum scopes required for each integration — avoid using admin:all unless your integration genuinely requires unrestricted access.

Scope inheritance

admin:all is a superset — it implicitly grants every other scope listed above, including future scopes added to the platform. Avoid granting it to integration keys; reserve it for your master automation account and Keme dashboard access.

Rotating Keys

We recommend rotating server API keys every 90 days, or immediately following any suspected compromise. Keme supports zero-downtime rotation: you can have two active keys simultaneously during a transition window.

Step 1 — Create the new key

Issue a new API key via the dashboard (Settings → API Keys → New Key) or programmatically using the API. Assign it the same scopes as the key being replaced.

1curl -X POST https://api.kemegames.com/v1/organizations/org_xxx/api-keys \
2  -H "Authorization: Bearer <accessToken>" \
3  -H "Content-Type: application/json" \
4  -d '{
5    "name": "Production Server Key v2",
6    "type": "server",
7    "scopes": ["tickets:read", "tickets:write", "players:read"]
8  }'

Step 2 — Deploy and verify

Update your application configuration with the new key and deploy. Both the old and new keys are valid simultaneously. Verify that your application authenticates successfully and that requests are completing without errors before proceeding.

• Monitor your error rate in the Keme Analytics dashboard for 15–30 minutes after switching.
• Check the lastUsedAt field on the old key via GET /v1/auth/me — it should stop updating once traffic has fully migrated.
• Keep the old key active throughout your rollout and canary window.

Step 3 — Revoke the old key

Once you have confirmed that no traffic is using the old key, revoke it. Revocation is immediate and permanent — any access tokens issued from the revoked key will be rejected on next validation (within one token TTL, up to 3600 seconds).

1curl -X DELETE https://api.kemegames.com/v1/organizations/org_xxx/api-keys/key_OLD \
2  -H "Authorization: Bearer <accessToken>"

Emergency revocation

If you suspect a key has been compromised, revoke it immediately from the Keme dashboard under Settings → API Keys without waiting to provision a replacement first. The platform will return 401 Unauthorized for all new requests from that key within seconds of revocation. Then follow steps 1 and 2 above to restore access.