Everything the KIT does, in one place

Every capability is a task: you send input, you get a result. There are no tokens, no context windows and no prompt engineering. A task has a published price, a documented unit and a fixed shape.

Four ways to run one. Web — every capability has its own page and runs in the browser; the free ones never leave your device. API — one authenticated POST, documented below. Email and Telegram — send the task to a KIT address. The API is one channel, not the product.

Create an account, get your key, run a task. No sales call, no waiting list.

Every API request carries Authorization: Bearer kit_live_…. Keys are 48 hex characters after the prefix.

We store only the SHA-256 hash of your key. That is deliberate: a database dump does not hand anyone your credentials — but it also means we genuinely cannot email you your key back. Lost it? We revoke and issue.

A bad key always returns 401 and never says why. Revoked, mistyped and never-existed are indistinguishable on purpose: telling you which one it was is telling an attacker too.

Routes carry no version prefix. /v1/* still resolves for older clients, but it is not the canonical form and new code should not use it.

Set webhook_url when you create a task and we POST the result there when it is ready. This is the recommended path: it costs less than polling and arrives sooner.

Verify the signature before you trust the body. Every delivery carries KIT-Signature: v1=<hex> and KIT-Timestamp: <unix seconds>. The signature is HMAC-SHA256 over the string <timestamp>.<raw body> — the timestamp and the dot are part of the signed payload, not decoration. Sign the raw bytes you received, not a re-serialized object.

Delivery is attempted up to 5 times with exponential backoff. A 4xx from your endpoint stops retrying immediately — we read it as “your handler is wrong”, not “try later”. Only 5xx and network errors retry. After that the delivery is dead-lettered.

Every error carries a stable error slug in the body. Match on the slug, not the message: messages are localized and may change.

Pay only for what you use. Add balance to your account (from $10.00) — it never expires — and every task draws from it at its published per-task price. Real dollars, not points.

Each task costs a base rate plus a unit rate, both published on the capability's own page and in the catalog below — from $0.002 per call. POST /estimate quotes a task without running it, and max_cost_usd on a task refuses it if it would cost more than you said.

Failed tasks are never charged. Free capabilities run in your browser and cost nothing at all.

Polling a task is capped at 1 request per second; over that you get 429 with Retry-After: 1. Use the webhook instead. Results are kept by size: 168 h for results up to 1 MB, down to 6 h for very large ones. GET /tasks returns 25 by default, 100 maximum. Signup is limited to 10 accounts per hour per IP.

Each capability links to its page, where you can run it, see a real example and the published price. Prices here come from the same catalog the Worker bills from — they cannot disagree.