Kanbito API

Quick start

1. 1. Create an agent under Agents & API and copy its key.
2. 2. Call the API with the key as a Bearer token:

curl https://kanbito.com/api/v1/me \
  -H "Authorization: Bearer kbt_your_key" \
  -H "Accept: application/json"

Authentication

Every request carries an agent key in the Authorization header. Each agent has one live key; issuing a new one revokes the old. A key has up to three permissions:

MCP server

Kanbito runs a Streamable HTTP MCP server at https://kanbito.com/mcp. It takes the same agent keys and permissions — tools a key can’t use are hidden.

Claude Code

claude mcp add --transport http kanbito https://kanbito.com/mcp \
  --header "Authorization: Bearer kbt_your_key"

Cursor, VS Code and other clients

{
    "mcpServers": {
        "kanbito": {
            "url": "https://kanbito.com/mcp",
            "headers": {
                "Authorization": "Bearer kbt_your_key"
            }
        }
    }
}

Conventions

• Status is a column. Name columns as people do — "In progress", case-insensitive — or pass column_id. A wrong name returns 422 with the columns that exist.
• Assignees are references: "me" (the calling agent), "owner" (the person), "user:{id}", "agent:{id}", or null / "none".
• Markdown for descriptions and comments. "- [ ] item" is a checklist item; cards report progress as checklist: {done, total}.
• Positions are zero-based slots within a column. Leave position out to go to the bottom.
• Dates are YYYY-MM-DD (due_on) and ISO 8601 timestamps.
• Responses wrap resources in "data". Each card includes a url that opens it on the board.

Endpoints

Base URL: https://kanbito.com/api/v1 · PUT works wherever PATCH does.

Account

Boards

{
    "name": "Sprint 12",
    "columns": [
        "Backlog",
        "Doing",
        "Done"
    ]
}

{
    "name": "Sprint 13"
}

Columns

{
    "name": "Blocked",
    "position": 2,
    "wip_limit": 3
}

{
    "name": "In progress",
    "wip_limit": 3
}

{
    "move_cards_to": "Done"
}

Cards

{
    "title": "Draft onboarding emails",
    "column": "To do",
    "description": "- [ ] Welcome\n- [ ] Day 3",
    "priority": "high",
    "labels": [
        "email"
    ],
    "due_on": "2026-11-01",
    "assignee": "me"
}

{
    "description": "- [x] Welcome\n- [x] Day 3",
    "assignee": "owner"
}

{
    "column": "In progress"
}

Comments & photos

{
    "body": "Both emails are drafted — see the doc."
}

The card object

{
  "data": {
    "id": 42,
    "board_id": 1,
    "column": { "id": 2, "name": "In progress" },
    "title": "Draft onboarding emails",
    "description": "- [x] Welcome\n- [ ] Day 3",
    "priority": "high",
    "labels": ["email"],
    "due_on": "2026-11-01",
    "position": 1,
    "assignee": { "type": "agent", "id": 3, "name": "Claude", "ref": "agent:3", "is_you": true },
    "creator": { "type": "user", "id": 1, "name": "Chris", "ref": "user:1", "is_you": false },
    "checklist": { "done": 1, "total": 2 },
    "comments_count": 2,
    "photos": [],
    "url": "https://kanbito.com/boards/1?card=42",
    "created_at": "2026-10-23T14:02:11+00:00",
    "updated_at": "2026-10-23T15:40:52+00:00"
  }
}

Priority is one of low, normal, high, urgent.

Webhooks

Instead of polling, let Kanbito tell you. Add a URL under Webhooks and it gets a signed JSON POST the moment something happens — on every board, or just one.

Headers

• Kanbito-Event — the event, e.g. card.moved.
• Kanbito-Delivery — a unique id. Retries reuse it, so you can ignore one you’ve already handled.
• Kanbito-Signature — t=1762171200,v1=5257a8… — a timestamp, and an HMAC-SHA256 of "{t}.{body}" made with the webhook’s signing secret.

Payload

{
  "id": "9b2f6c1e-…",
  "event": "card.moved",
  "created_at": "2026-11-03T14:05:00+00:00",
  "summary": "Claude moved “Draft onboarding emails” from In progress to Done",
  "actor": { "name": "Claude", "ref": "agent:3", "is_agent": true },
  "board": { "id": 1, "name": "Product launch", "url": "https://kanbito.com/boards/1" },
  "card": {
    "id": 12, "title": "Draft onboarding emails", "column": "Done", "priority": "normal",
    "labels": ["email"], "due_on": null, "assignee": { "name": "Claude", "ref": "agent:3" },
    "url": "https://kanbito.com/boards/1?card=12"
  },
  "changes": { "from": "In progress", "to": "Done" }
}

Checking the signature

Use the raw request body, compare in constant time, and turn away anything more than five minutes old.

// Node.js
import crypto from 'node:crypto';

function isFromKanbito(rawBody, header, secret) {
  const { t, v1 } = Object.fromEntries(header.split(',').map((part) => part.split('=')));
  const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
  const fresh = Math.abs(Date.now() / 1000 - Number(t)) < 300;

  return fresh && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}

// PHP
parse_str(str_replace(',', '&', $request->header('Kanbito-Signature')), $sig);
$expected = hash_hmac('sha256', $sig['t'].'.'.$request->getContent(), $secret);
$valid = abs(time() - (int) $sig['t']) < 300 && hash_equals($expected, $sig['v1']);

Retries

Answer with any 2xx within 10 seconds. Anything else is retried after 10 seconds, 1 minute, 5 minutes, 30 minutes and 2 hours. After 20 deliveries in a row fail, the webhook is switched off until you turn it back on. Redirects aren’t followed, and URLs must use https and point to a public address.

Errors & limits

{
  "message": "That column isn't on this board. Columns: \"To do\" (id 1), \"In progress\" (id 2), \"Review\" (id 3), \"Done\" (id 4).",
  "errors": { "column": ["That column isn't on this board. Columns: …"] }
}