Kling's video generation interface uses an asynchronous task model. The first step in integration is not writing requests; it is obtaining the credential, putting it in the right place, and controlling its permissions. Many 401 and 403 responses are not code problems at all — the key was copied incorrectly, an environment variable did not take effect, or the account simply has not enabled the model.

This article follows the order "create, configure, troubleshoot, rotate" to explain the credential types and security practices common on the Kling open platform in 2026. Interface details change quickly; use the official console and documentation as the source of truth.

Note: Kling, Kling AI, and Kuaishou are trademarks of their respective owners. This article is for technical explanation only and implies no affiliation with or agency for those companies.

1. First, decide which credential you need

Two authentication forms are common on Kling:

  • API key: created in the developer console and sent as Authorization: Bearer <API_KEY>. Newer interfaces distinguish the model by path, so this is the preferred method.
  • AccessKey + SecretKey: mainly used by legacy interfaces. Each request signs a JWT with the SecretKey and puts the JWT in the Bearer header. The AccessKey goes in the iss claim.

The security requirements differ. An API key is a long-lived credential; if it leaks, it can be called directly. With AccessKey/SecretKey, the SecretKey is a signing key; if it leaks, an attacker can issue tokens themselves. Either way, never put credentials in front-end code, mobile app bundles, or public repositories.

2. Steps to create a Kling API key

The international console is at https://kling.ai/dev/api-key; sign in with a Kling account to manage keys. For mainland China, the entry point and available models are whatever the official page shows — do not assemble domains from third-party tutorials.

  1. Sign in to the developer console and open the API key management page.
  2. Click "+ Create a new API Key" and name it by project, environment, and purpose, for example video-prod-cn or video-test.
  3. Copy and save the key immediately. The page usually shows it only once; after you close it, the full key cannot be viewed again.
  4. Store the key in a password manager or cloud secret management service, and record its creator, purpose, and rotation date.
  5. Verify authentication once with the cheapest possible task and record the returned request_id for later troubleshooting.
  6. Confirm the account has purchased a usable resource pack or enabled postpaid billing before starting formal integration.

Naming is not bureaucracy. When abnormal calls appear, the key name lets you quickly identify which service and environment is involved instead of shutting down every workload at once.

3. Legacy AccessKey/SecretKey and JWT

Legacy interfaces specify the model with model_name in the request body and require you to generate the JWT yourself. The official documentation specifies HS256 signing, with iss set to the AccessKey, exp set to the current time plus 1,800 seconds, and nbf set to the current time minus 5 seconds.

import os
import time
import jwt  # PyJWT

access_key = os.environ["KLING_ACCESS_KEY"]
secret_key = os.environ["KLING_SECRET_KEY"]

token = jwt.encode(
    {
        "iss": access_key,
        "exp": int(time.time()) + 1800,
        "nbf": int(time.time()) - 5,
    },
    secret_key,
    algorithm="HS256",
    headers={"alg": "HS256", "typ": "JWT"},
)
print(token)

A few easy mistakes:

  • exp is Unix seconds, not milliseconds. A millisecond value produces a token that expires far in the future but may be rejected outright by the platform.
  • Keep server clocks synchronized. Excessive clock skew makes the nbf check fail, which appears as "token not yet valid".
  • A JWT is valid for only 30 minutes. Regenerate it during long polling loops; do not reuse one token throughout.
  • Do not mix JWTs and API keys. New interfaces use API keys; only legacy interfaces use AK/SK signing. Follow the documentation for the interface you call.

4. Permissions, resource packs, and concurrency limits

The permission error in Kling's documentation is mainly business code 1103 (HTTP 403), meaning "no permission to request this API or model". It is usually related to account status, whether the model is enabled, and the resource pack — not to the key itself being invalid.

Three kinds of limits need to be distinguished:

  • Account status: 1100 means the account status is abnormal; 1101 means postpaid arrears; 1102 means the prepaid resource pack is exhausted or expired.
  • Model permission: 1103 means the current account may not call that interface or model.
  • Concurrency quota: video tasks get concurrency slots from the resource pack, and exceeding them returns 1303. The official documentation states clearly that all API keys under the same account share one concurrency pool.

This means creating more keys does not buy more concurrency, nor does it truly isolate production traffic from test traffic. If you need hard isolation, use a separate account or a separate resource pack, and add a task queue at the architecture level. Kling's documentation does not currently offer scopes such as read-only or generate per interface; permissions are tied mainly to the account and purchased capacity. If the console later adds fine-grained authorization, the console is the authority.

5. Keys in environment variables and secret management

Environment variables are the minimum; production should use a cloud Secrets Manager, Kubernetes Secrets, or a comparable secret service. Do not commit keys to Git, and do not print full values in logs.

Recommended environment variable names:

KLING_API_KEY=...
KLING_ACCESS_KEY=...
KLING_SECRET_KEY=...
KLING_BASE_URL=https://api-singapore.klingai.com

Keep only .env.example in the repository, with placeholders. At startup, check that variables exist and fail immediately if they are missing, rather than sending requests with empty strings. Log at most the first four and last four characters of a key, and keep the request_id. Browsers and mobile apps must never hold keys directly; all video tasks should be submitted through a backend proxy.

6. 401 troubleshooting table

Business code HTTP Meaning Common cause Action
1000 401 Authentication failed Request header format is wrong Check whether Authorization is present
1001 401 Authorization header is empty Empty environment variable, proxy stripped header Log the variable length, check gateway forwarding
1002 401 Invalid credential Key copied incompletely, revoked, or wrong environment Recreate and update the key
1003 401 Token not yet valid Server clock skew, incorrect nbf Sync NTP, check the time unit
1004 401 Token expired Legacy JWT older than 30 minutes Generate a new JWT

Troubleshoot from the outside in: first confirm the request actually carries the header, then confirm the key belongs to the current environment, and only then suspect the platform. If you use a reverse proxy or serverless platform, check whether it filters the Authorization header.

7. Direct official access or an API gateway

With direct access to the Kling open platform, the account, resource packs, call logs, and bills stay in your hands; this suits teams with purchasing and operations capability. An API gateway can consolidate multiple video models under one key and one bill, reducing integration effort.

When choosing a gateway, confirm four things: whether the Kling video channel is enabled, whether asynchronous tasks and external_task_id pass through unchanged, whether callback URLs pass through, and how result URLs are delivered. A gateway that only supports OpenAI-compatible text endpoints cannot run video tasks as-is. You can review models and pricing and sign up to test, validate with the smallest task, and then decide whether to move production traffic.

8. Rotation and leak response

Key rotation should be routine, not an emergency action after an incident. Rotate every 90 days, and immediately when staff leave or projects change hands.

  1. Create a new key in the console with the date in the name, for example video-prod-20261019.
  2. Write the new key into the secret management service, update the test environment, and run one shortest-path task.
  3. Roll out to production gradually and watch 401s, 403s, and task success rates.
  4. Once the new key is stable, revoke the old key.
  5. Record the rotation time, the operator, and affected services.

If a leak is suspected, revoke the old key first, then review call records and bills, and only then investigate the leak path. Changing code without revoking the credential leaves the risk in place. Webhook secrets are a separate credential; the official platform supports old and new secrets coexisting during a 7-day grace period, so they can be rotated independently of API keys.

FAQ

What is the difference between a Kling API key and AccessKey/SecretKey?

An API key is a single credential sent directly in the Bearer header; AccessKey/SecretKey is the legacy signing mechanism that requires you to generate a JWT. Prefer API keys for new interfaces and follow the documentation for JWTs on legacy ones.

Can one account create multiple API keys? Does concurrency add up?

You can create keys by environment and project, but the official documentation states that all keys under one account share a concurrency pool; more keys do not add concurrency. Use separate accounts or separate resource packs when you need hard isolation.

A 401 says the credential is invalid, but the key looks correct. What should I check?

Check whether the full string was copied, whether spaces or line breaks slipped in, whether requests go to the correct region, and whether a proxy rewrites or removes the Authorization header. If it still fails, create a new key for a control test.

Does a Kling API key expire?

The API key itself usually does not expire on a fixed schedule, but it can stop working because of revocation, account status, or permission changes. Legacy JWTs are valid for 30 minutes. Follow the console and official documentation for the exact policy.

Do I still need a Kling account if I use an API gateway?

Not necessarily. A gateway usually hosts the upstream account and billing, but available models, concurrency, callback support, and data retention are decided by the gateway. Confirm the video channel is enabled and read its terms of service before integrating.

Related reading: