Scoped API keys
Every key carries what it may do: read:tasks, write:tasks, read:projects. A key belongs to the organization, not to a person.
Signed webhooks
When something happens on the board it goes to your endpoint — signed, retried, and automatically disabled if it keeps failing.
An MCP server
Model Context Protocol tools are ready: an AI assistant can list, create, update and move tasks between columns, and post comments.
How it works
A versioned, documented REST API
Organization-scoped endpoints under /api/v1. The OpenAPI 3.1 document is public — point Postman, Scalar, Swagger UI or a code generator straight at it.
Keys are stored as hashes only
A kt_live_ key is shown to you once, at the moment it is created; the server keeps only its hash. Lose it and you issue a new one — nobody can read the old one back.
Webhooks are guarded on the way out
The destination is checked against the real IP resolved at connection time, private network addresses are refused, and redirects are not followed. A subscription that keeps failing is disabled automatically.
MCP runs inside the application
There is no separate server to stand up. The same API key and the same scopes apply — an agent given a read-only key cannot write.
Which plan is this on?
API keys and webhooks on the free plan: 1 and 1, and its keys are read-only — a write-scoped key requires Pro. Pro is 50 keys and 50 webhooks; Business is 200 and 200. The OpenAPI document is public and needs no account at all.
Frequently asked questions
What is MCP, and why does it matter?
Model Context Protocol is how an AI assistant connects to outside tools. Because KyroTask ships an MCP server, you can tell your assistant “list the open work on this project and open a task for this” and it does it directly, with no copy-and-paste in between.
How do I verify a webhook signature?
Every subscription carries its own signing secret and every delivery is signed with it. The secret is stored encrypted; if it cannot be decrypted the delivery is failed rather than sent unsigned.
Does an API key inherit a user’s permissions?
No. A key belongs to the organization and carries only the scopes it was given. If the person who created it leaves, what the key can do does not change — you revoke it in settings when you want it gone.