API tokens

Bearer tokens for POST /check. Each token resolves to exactly one seller row and can be revoked instantly.

Tokens are shown once

Store the full value in the seller bot's secret manager. Khusela keeps only a prefix and a hash, so a lost token must be replaced.

Auth docs

Workspace tokens

5 active · 1 revoked · 2 expire in 14 days.

Name Token prefix Seller Scopes Created Last used Status
WhatsApp bot · production
Deployed by Thandi
 khs_live_7f3a… Thandi's Threads check:write 12 Aug 2026 Today 10:42 Active
WhatsApp bot · production
Deployed by Sipho
 khs_live_c81b… Sipho Auto Spares check:write 12 Aug 2026 Today 10:37 Active
Bank webhook
Capitec business
 khs_live_4d09… Thandi's Threads bank:write 03 Sep 2026 Today 10:40 Active
Reporting export
Read-only dashboard feed
 khs_ro_a20e… All sellers checks:read 21 Sep 2026 Yesterday 18:02 Expires in 14d
Kasi Kicks bot
Paused after STOP spike
 khs_live_88be… Kasi Kicks Sneakers check:write 28 Jul 2026 Today 10:24 Revoked
Showing 5 of 6 tokens Revocation takes effect within 5 seconds.

Create a token

Scope the token to one seller and the minimum permissions.

check:write checks:read bank:write expected-sales:read
Most seller bots only need check:write.
The value appears once after creation.

Authenticate a request

Send the token in the Authorization header. Never put it in a URL.

curl -X POST https://api.khusela.internal/check \
  -H "Authorization: Bearer khs_live_7f3a…" \
  -F "file=@receipt.png" \
  -F "expected_sale_id=ES-88213"

Token rules

One seller per tokenThe seller_id is derived from the token, never from the request body.
Enforced
Hashed at restOnly a 12-character prefix is stored in plain text.
SHA-256
RevocationRemoving a token invalidates the next request within 5 seconds.
<5s
RotationCreate the replacement first, then revoke the old token.
Manual