Overview

Build on top of your Kyo workspace. Kyo exposes a REST API secured by OAuth 2.0, a CLI for the terminal, and an MCP server that lets AI agents like Claude and Cursor read and write your CRM, tasks, and projects — always as you, never beyond your permissions.

Explore the platform

REST API Read and write deals, people, companies, tasks, and more over HTTPS. OAuth 2.0 Authorization code + PKCE flow for building your own integrations. CLI Your whole workspace from the terminal — scriptable, JSON-first. MCP server Give Claude, Cursor, and other AI agents secure access to Kyo.

How access works

Every request to the Kyo API runs as the user who authorized it. There are no unscoped admin keys: access tokens are issued through OAuth 2.0 with PKCE, carry an explicit set of scopes, and are enforced by the same permission system the Kyo app itself uses — workspace isolation, roles, and private-task visibility all apply unchanged.

  • Scoped — a token holds only the scopes the user granted (for example deals:read or tasks:write), and can never exceed what that user can do in the app.
  • Short-lived — access tokens expire after 1 hour; refresh tokens rotate on every use.
  • Revocable — users can revoke an authorized app at any time from Settings → API in Kyo.
  • Non-destructive — v1 of the API has no delete. Records can be created and updated, but never hard-deleted through the API.

Quickstart

From the terminal

The fastest way to make your first API call is the Kyo CLI:

bash
npm install -g kyo-cli
kyo login          # opens your browser to authorize
kyo deals list     # your first API call

Connect an AI agent

Give Claude Desktop, Claude Code, or Cursor direct access to your workspace through the MCP server — 36 tools covering deals, tasks, pipelines, and more:

json
{
  "mcpServers": {
    "kyo": { "command": "npx", "args": ["-y", "kyo-cli", "mcp"] }
  }
}

Build your own integration

Register an OAuth application in the Kyo app under Settings → API (workspace admins), then implement the authorization flow to request access to your users' workspaces and call the REST API.

Base URL & versioning

All REST endpoints live under a versioned /v1 path:

base url
https://pvozbkuhjofzitsmpspf.supabase.co/functions/v1/api-v1/v1

Requests and responses are JSON. Breaking changes will only ship under a new version prefix — /v1 paths stay stable.

Rate limits

The API allows 60 requests per minute per token and 600 requests per minute per workspace. Every response carries X-RateLimit-Remaining and X-RateLimit-Reset headers. See rate limits in the API reference for details.