Knotch Authentication

generated: '2026-08-13'
method: searched
source: https://help.knotch.com/en/articles/159-events-api-v11-technical-overview
docs: https://help.knotch.com/en/articles/159-events-api-v11-technical-overview
note: >-
  Upgraded from the derived baseline (which read only the HTTPBearer securityScheme out of
  https://events.knotch.it/openapi.json) with what Knotch's own Events API documentation states.
  Knotch runs three distinct credential models across its surfaces and only one of them is an
  API key.
summary:
  types:
  - http
  api_key_in: []
  oauth2_flows: []
  self_service_credentials: false
  credential_issuance: >-
    Not self-service. The Events API documentation says "To obtain or rotate an API key, contact
    your Knotch Client Success Manager." The Event Pixel Account ID and the Verification Pixel
    kvpid are likewise issued by Knotch staff.
schemes:
- name: HTTPBearer
  type: http
  scheme: bearer
  header: 'Authorization: Bearer <api-key>'
  transport: HTTPS required
  applies_to: Knotch Events API (https://events.knotch.it)
  rotation: contact Knotch Client Success Manager
  sources:
  - openapi/knotch-events-api-openapi.yml
  - https://help.knotch.com/en/articles/159-events-api-v11-technical-overview
non_api_key_credentials:
- name: Measurement Account ID
  applies_to: Knotch Event Pixel (https://t.knotch.it/receive/beacon.gif)
  carried_in: account_id query parameter
  kind: account identifier, not a secret
  issuance: Knotch Client Success team
  source: https://docs.knotch.it/event_pixel/
- name: kvpid
  applies_to: Knotch Verification Pixel
  carried_in: data-kvpid HTML5 data attribute on the script element
  kind: per-publisher verification identifier
  issuance: request via blueprint@knotch.com
  source: https://docs.knotch.it/verification_pixel/
- name: Unit ID
  applies_to: Knotch Measurement Unit API
  carried_in: knotch_<id> CSS class on the placeholder container
  kind: unauthenticated public identifier
  source: https://docs.knotch.it/unit_api/
webhook_authentication:
- name: Segment webhook Bearer + X-Signature HMAC
  applies_to: POST /conversion_events/segment/{account_id}
  detail: >-
    Segment destinations send the same Authorization Bearer header, and additionally include an
    X-Signature HMAC over the first event in each batch, which Knotch validates.
  source: https://help.knotch.com/en/articles/159-events-api-v11-technical-overview
platform_authentication:
- name: SSO
  applies_to: Knotch One web platform (not the API)
  detail: >-
    Clients may enable Single Sign-On; Knotch does not receive the authorized user list and only
    creates a user record after a first successful SSO login.
  source: https://help.knotch.com/en/articles/49-how-does-sso-user-access-work-in-knotch-one
gaps:
- No OAuth 2.0 or OpenID Connect surface is published for the API.
- No scope or permission model is documented; the Bearer token is account-wide.
- No documented key prefix, key format, expiry, or programmatic rotation endpoint.
- The published OpenAPI declares HTTPBearer but supplies no bearerFormat and no description.