Trainer and search endpoints require a JWT Bearer token for a company user (an end-user of your app):

1Authorization: Bearer <jwt_token>

Obtaining a JWT token — call the verify-api-key endpoint from your backend (never embed your company API key in client code):

1POST https://data.kinestex.com/api/companies/me/verify-api-key/

1curl -X POST "https://data.kinestex.com/api/companies/me/verify-api-key/" \
2  -H "x-api-key: your_api_key_here" \
3  -H "Content-Type: application/json" \
4  -d '{"user_id": "user-abc-123"}'

The response includes a token field — use it as the Bearer token in all subsequent API requests. The user_id you provide should match the user_id used across other KinesteX endpoints and SDK launches so user data stays consistent.

Session tokens (recommended for client launches): instead of shipping a raw API key to the client, your backend can mint a short-lived session for SDK launches — see Session Auth & Managed Subscriptions.

Language: the trainer replies in the user's language. Set either header on any trainer request (defaults to English):

1Language: es              # custom header, takes precedence
2Accept-Language: es-MX    # standard header, used as fallback

Locale tags are normalized to their base code (es-MX → es).