Skip to main content

​
Overview

The Company V1 API (rest.kyckr.com) is a server-to-server API. It does not send CORS headers, so web browsers will block requests made directly from a web page. Call the API from your own back-end service and never expose your API key in browser code.

​
What changed

Responses from rest.kyckr.com, including the Test environment at rest.kyckr.com/test, no longer include these headers:
  • Access-Control-Allow-Origin
  • Access-Control-Allow-Headers
  • Access-Control-Expose-Headers
  • Request-Context
  • X-Powered-By
  • X-AspNet-Version
Endpoints, request parameters, authentication and response bodies are unchanged.

​
What you need to do

  • Server-side integrations: nothing. Requests from your own servers work exactly as before.
  • Browser-based calls: if any web page calls rest.kyckr.com directly from the browser, move that call to your back-end service. Your back end calls the API with your API key and returns the result to your page.

​
Additional resources