Get access token
Exchange your client_id and password for a short-lived bearer access token. This is the only endpoint that authenticates with just the x-api-key header — every other call additionally requires Authorization: Bearer <access_token>. On success the API returns 200 with the standard { message, data } envelope, where data carries access_token, token_type (Bearer), and expires_in (seconds). The token is valid for 3600 seconds (1 hour); there is no refresh-token flow — call this endpoint again to obtain a new token when the current one expires or when any request returns 401. Cache the token and reuse it across requests rather than re-authenticating per call. See the Authentication guide for the full header reference.
Authorizations
API key issued by Kira. Required on every request, including /auth.