Developer platform
Build on Kang Workspace
One API for workspaces, meetings, boards, documents and finance data. Scoped keys, signed webhooks, OAuth 2.1 apps and an MCP endpoint for AI agents — all documented and rate limited.
Keys and webhook secrets are managed from inside your workspace. A Kang Workspace account is required.
curl https://workspace.kangopenbanking.com/api/v1/workspaces \
-H "Authorization: Bearer kw_live_xxxxxxxxxxxxxxxx"Everything an integration needs
The same building blocks power our own modules, so what you integrate with is what we run in production.
REST API
Versioned JSON endpoints under /api/v1. Predictable resources, cursor-friendly listing and machine-readable errors.
Scoped API keys
Issue kw_live_ keys per integration with explicit scopes. Keys are shown once and stored only as peppered hashes.
Signed webhooks
Subscribe to workspace events and verify each delivery with an HMAC-SHA256 x-kang-signature header. Retries use exponential backoff.
Integrations
Connect Slack, Jira, Miro, Google and Zapier. Credentials are encrypted at rest with AES-GCM and scoped to one workspace.
MCP for AI agents
A bearer-protected /mcp endpoint exposes workspace tools to Claude, ChatGPT and any MCP-compatible agent.
Rate limits & audit
120 requests per minute per key, per-IP throttling on public routes, and an audit record for every privileged call.
From key to production in four steps
- 01
Create a key
Open the Developer Portal inside your workspace and issue a scoped API key. Copy it once — it is never shown again.
- 02
Call the API
Send the key as a bearer token. Read the OpenAPI 3.0 description to generate a typed client in any language.
- 03
Subscribe to events
Register an endpoint, store the whsec_ secret, and verify every signature before you act on a payload.
- 04
Go further
Authorise third-party apps through OAuth 2.1 with PKCE, or expose your workspace to AI agents over MCP.
Security you can audit
Every request is scoped to a workspace, checked against row-level security and recorded. Nothing leaves a workspace boundary without an explicit grant.
- Keys stored as HMAC-SHA256 hashes with a server-side pepper
- Reveal-once secrets and one-click revocation
- HMAC signatures on every outgoing webhook delivery
- Inbound webhook signature verification per provider
- AES-GCM encryption for stored integration credentials
- Per-key and per-IP rate limiting with clear 429 responses
Ready to make your first call?
Sign in to your workspace, issue a scoped key from the Developer Portal, and read the API reference alongside your first request.