API Reference

The Klero Public API is versioned under v1.

Base URLs

All documented endpoints in this reference live under the /v1/ prefix inside the public API path:

Environment	Base URL
Subdomain	https://{projectSlug}.klero.ai/api/v1/
Custom domain	https://feedback.yourdomain.com/api/v1/

Authentication

Customer-authenticated endpoints use the X-Customer-Token header:

X-Customer-Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

See Authentication for token issuance.

Anonymous identity

Anonymous actions are controlled by the project settings returned by GET v1/settings.

When anonymous interaction is enabled for a project:

• same-origin requests use the Klero anonymous cookie automatically
• cross-origin requests can send X-Klero-Anon-Id
• vote and comment-like toggles should also send anonymous: true in the request body when not using X-Customer-Token

Anonymous settings flags

Flag	Meaning
allow_anonymous_posting	Unauthenticated users may create feedback items
allow_anonymous_upvoting	Unauthenticated users may vote on feedback items
allow_anonymous_commenting	Unauthenticated users may create comments and like comments

Rate limits

Rate limits are applied per IP address.

Group	Limit
Read endpoints	120/min
Write endpoints	20/min
Vote / like endpoints	30/min
Comment update / delete endpoints	15/min

When a limit is exceeded, the API returns 429 Too Many Requests.

Common error responses

Error responses return JSON with a message field. Many write endpoints also include success: false.

{
  "message": "...",
  "success": false
}

Status	Meaning
400	Bad request, such as missing anonymous identity for an anonymous vote / like
401	Authentication required for a customer-owned action
403	Feature disabled, blocked customer, or action forbidden
404	Resource not found or feature disabled
422	Validation error, often with an errors object
429	Rate limit exceeded