Skip to main content
We offer 2 forms of authentication for apps:
  • OAuth
  • No authentication
Deciding which is right for your app depends on whether you are accessing the Kit API or whether you require authentication to tie a Kit account with an external account for your service. Though we do offer API keys to access the V4 API, these should only be used for testing purposes, with OAuth required for the app to go live.
Though keys offer a quick method of testing the API before finalising your app, some endpoints - such as the Create purchase or Bulk... endpoints - require OAuth authentication, so will not be able to be tested this way. Specific authentication requirements can be found for each endpoint in the API documentation.
The only time OAuth is not required would be for apps that only offer plugin functionality that rely on publically available endpoints that require no authentication. A great example of this would by the Kit GIPHY app, that requires no authorization from the creator for Kit to access GIPHY’s library of images.

​
Full app authentication flow

The authentication flow varies based on whether your app offers API access, plugin access or both. To learn about these flows in depth, visit the API authentication and plugin authentication pages, which will help guide you through the requirements and share examples to help you get up and running. The below diagram and step-by-step outline will describe the full flow when you have both API and plugin access configured for your app. If you are looking to build an app with just API or plugin access, visit the specific API authentication and plugin authentication pages. full app authentication flow
1

Creator installs your app

Authentication begins with the creator installing your app from the Kit App Store or your app’s details page. They can click the “Install” button on either page.
Kit App Store
GIPHY app details page
If you want to start this flow from your site as well, utilize our install url, https://app.kit.com/apps/:app_id/install, appended with k_app_id=k_:app_id (which allows us to attribute sign-ups to your particular app). To find your app id - click the “Preview” button for the app on the Build tab of the Kit App Store and the id will be found in the URL path app.kit.com/apps/:app_id.

For example, for the GIPHY app, you would send your users to https://app.kit.com/apps/717/install?k_app_id=k_717

You can also redirect creators back to a specific page on your site after installation completes by adding a return_to query parameter. See externally initiating installations for details.

2

Redirect to plugin authorization flow

The creator is then sent to your service’s OAuth flow, whereby the creator grants Kit access to your platform, in order to retrieve the data needed for your plugin(s). Here, Kit will use the OAuth endpoints served by your authentication server to request access tokens, that will be used to authenticate all future requests to your platform.
Canva OAuth page
3

API authentication

Once plugin access is completed, API authentication begins, with Kit kicking off the flow by making a GET request to the authorization URL you have set up for your app.
It is important that at this stage, you store the redirect property that is appended to the GET request, as this will be the URL your app will need to redirect to once the Oauth flow is completed
Once the creator gives authorization for your service to access the Kit API on your behalf, your app will request an access and refresh token that will be used for all future app calls to the API.
Kit OAuth page
4

Redirect the user to complete the installation

Once API authentication is completed, redirect the user back to the redirect, URL provided as a query parameter in the initial authorization request. This will ensure the installation flow is tracked and completed properly. This property currently sends users back to your app’s details page, which will help guide them through using and getting the most out of your app they have just added to their creator kit.
If you have set up the Redirect URL after install field in your app’s settings, a modal prompting creators to continue their journey on your configured site will appear at this point. See this section in the app details page guide for more details. If the installation was externally initiated with a return_to parameter, the creator is redirected directly to that URL instead.
example redirect flow
5

Ongoing refresh token flow

With installation now complete, both Kit and your service will continue to refresh access tokens as required; using the refresh token shared in the same response as the access token to request an updated access token, when the current one has expired.

​
Disconnecting your app

The connection between Kit and your service can be torn down from either side. Handling both directions keeps you from holding stale tokens — or Kit holding stale credentials — after a creator walks away.

​
When a creator disconnects on your side

If a creator disconnects or uninstalls your app from your platform, call Kit’s OAuth token revocation endpoint to invalidate the credentials Kit issued you. A single call to POST /v4/oauth/revoke:
  • Marks the access token (and any associated refresh token) as revoked.
  • Marks the Kit-side installation as uninstalled, so your app no longer shows as installed for that creator.
  • Asynchronously clears any partner credentials Kit is holding for that creator on your behalf.
Treat this as your clean teardown signal — one request keeps the connection state in sync on both ends. See the OAuth token revocation reference for the request format and code samples.
Per RFC 7009, the endpoint returns 200 OK even if the token is already revoked, expired, or unknown, so you can safely call it without first checking whether the token is still valid.

​
When a creator uninstalls on Kit’s side

If a creator uninstalls your app from within Kit, Kit will make a POST request to the revoke token URL you configured for your plugin, so you can tear down the connection on your end. See revoking an access token for the request body and code samples.

​
Externally initiating installations

You can now direct users to install your app directly from your own website or marketing materials, without requiring them to first visit the Kit App Store.
The installation URL only works for other creators once your app is published. Before then, it only works on your own Kit account. See connecting an unpublished app for what creators see, and what stops working, if they connect your app before it’s published.
This installation flow ensures both plugin and API authentication are completed properly, just like installations initiated from the Kit App Store. After successful installation, users will be redirected back to the Kit App Store where we can track the completed installation. If your app has plugins, send creators to the installation URL rather than straight to Kit’s OAuth authorization URL. Authorizing through OAuth alone grants API access, but it doesn’t connect your app’s plugins. To do this, point users directly to the installation URL using this format: https://app.kit.com/apps/:app_id/install?k_app_id=k_:app_id replacing :app_id with your specific app ID. The k_app_id parameter allows us to attribute new Kit signups to your app. If you’d like the user to return back to your site after completing installation, you’ll need to configure allowlisted domains in your app settings. This is needed for security reasons. Then include a URL, including the scheme, that you’d like the user to be redirected back to when the install is finished in the return_to query param. The domain must be one of the domains that you allowlisted in your app settings. https://app.kit.com/apps/:app_id/install?k_app_id=k_:app_id&return_to=https://yoursite.com/example/path

​
Finding your app ID

You can locate your app ID in two ways:
From the Build tab
  • Go to the Build tab in the Kit App Store
  • Click the ‘Edit’ button on your app” />
  • Extract the ID from the URL (e.g. https://app.kit.com/apps/924/edit means your app ID is 924)
From your app details page
  • The app ID appears at the end of your app’s details page URL (e.g. https://app.kit.com/apps/924)

​
Connecting an unpublished app

Publishing your app through Kit App Store review is how it becomes available to other creators. Until then, the installation URL and your app details page only work on your own Kit account, so you can build and test there. If a creator on another account authorizes your app through Kit’s OAuth authorization URL before it’s published, they can still grant it API access. Kit treats that connection as an unverified app.
Plugins only work for other creators once your app is published. Kit authorizes your plugins as part of the full installation flow, which other accounts can’t reach until then. Content blocks, media sources and automation nodes from your app won’t appear for creators who connect it before it’s published; they only grant API access. Your plugins keep working on your own account, so you can still build and test them there.

​
What creators see

On the consent screen, Kit tells the creator that it hasn’t reviewed your app, that your app will be able to view and change their Kit account data, and that your terms and privacy policy apply rather than Kit’s. Kit links to the privacy policy URL from your app settings, if you’ve set one. The creator has to tick a box confirming they understand you’re responsible for how the app uses their data before they can grant access. Kit also tells them that uninstalling stops your app’s access but doesn’t delete data it already has, and that they should contact you to request deletion. Kit's OAuth consent screen for an unverified app, showing the unreviewed app warning and the required acknowledgement checkbox In their Manage tab, your app is listed under Unverified apps, separate from apps Kit has reviewed, with an Unverified badge. Your app isn’t linked to an app details page, and it doesn’t appear anywhere in the Kit App Store for other creators to find. The Manage tab of the Kit App Store, showing a reviewed app above an Unverified apps section with an Unverified badge

​
What stays the same

  • Plan eligibility. Creators need a plan that can install apps, just as they would for a published app.
  • Uninstalling. Creators can uninstall your app from the Manage tab at any time. This revokes the access tokens Kit issued to your app. See disconnecting your app to keep both sides in sync.
Once you’ve installed your app on your own account, you’ll see the Unverified badge on it in your Manage tab until it’s published. This is expected. If your app has plugins, install it on your own account through the installation URL. Authorizing it through OAuth alone doesn’t connect its plugins, so they stay available to install from your app details page.
If you want creators beyond your own account to use your app, and particularly if it includes plugins, submit it for review.