API

Kilo IoT Server API overview — REST and gRPC access, scoped keys, and cloud or on-premise integration endpoints.

The Kilo IoT Platform exposes programmatic access so external systems can read and manage your deployment's data and configuration — and now send commands to your devices — covering backend integrations, analytics and reporting pipelines, industrial and automation tooling, and custom applications.

Use the API reference for the complete list of endpoints, request fields, responses, and required scopes. This section covers what the API is for, how to choose a protocol, how requests authenticate, and where to manage keys.

Device control is part of the API: a key with the Commands scope can create a device's commands and dispatch them as downlinks (on/off, setpoints, and the like). See Device Commands for the in-app workflow, and the API reference for the command endpoints.

What's available

Two protocols are offered on the same secured endpoint:

• REST — the primary path for most integrations. Standard HTTPS and JSON, usable from any HTTP client. Start here unless you have a specific reason not to. See Public REST API.

• gRPC — the advanced / on-premise path. Choose REST unless you specifically need gRPC for an on-premise or typed service-to-service integration. See gRPC API.

Alongside them, a separate endpoint serves AI clients rather than code you write:

• MCP — connect an MCP-capable AI client, such as Claude Code or Claude Desktop, to your organization. You authorize it in the browser with your usual Kilo account instead of issuing a key, and it works within your own permissions. See MCP Server.

Authentication

Requests are authenticated with a scoped API key in the X-API-Key header (format kilo_<key>), plus your organization context in X-Organization-Id. Keys are created and managed in Settings → API Keys; the concepts are summarized in Authentication & API keys, and the full key-management workflow is in API Keys.

Cloud and on-premise

Cloud deployments use the managed endpoint above. On-premise installations expose the same API within your own network boundary, where gRPC is a natural fit for internal service-to-service automation — but REST remains available and is still the simplest place to start.

In this section

• Public REST API — the standard integration path.

• gRPC API — the advanced / on-premise path (typed, service-to-service).

• MCP Server — connect your own AI client to your organization.

• Authentication & API keys — how requests are authorized.

• Examples — a minimal authenticated request to get started.