API access
Let your own AI assistant or scripts work with your ledger: ask for your net worth, log a trade, record a balance change. Access goes through personal tokens you create and revoke yourself, and a Read only token can see your data but never change it.
How to use
- Open Settings, go to API access, and press the + button.
- Give the token a name, pick its Access (Read only or Read & edit) and when it Expires, then press Generate token.
- Copy the token when it appears. It is shown only once.
- Download the skill and add it to your assistant's skills folder, then give the assistant your app's web address and the token. The skill tells it everything else.
Your own scripts can use the same token; the full technical description of the API is published at /api/openapi.json.
Your app's address is app.krosos.com for the hosted app, or the local address shown in API access on the desktop app. Tokens already carry everything else needed: paste one in as-is.
MCP, for assistants that speak it (Claude, Cursor and most agent tools): the app also exposes the same capabilities as an MCP server at /api/mcp, which is sturdier than the skill because every operation is a typed tool. In Claude Code that is one command:
`` claude mcp add krosos --transport http https://app.krosos.com/api/mcp --header "Authorization: Bearer YOUR_TOKEN" ``
On the desktop app, swap in the local address shown in API access. In Cursor or Claude Desktop, add the same URL and header in the MCP settings. A Read only token works and keeps the write tools refused; the same skill-vs-token rules below apply unchanged.
On the desktop app it is simpler: there is no sign-in, so an assistant running on the same machine needs no token. Download the skill, give it the address shown in API access, and leave Krosos open while it works. Nothing off your machine can reach it.
Good to know
- Read only is the safe default for an assistant. It can answer questions about your money but cannot change anything. Mint a Read & edit token only if you want it logging entries for you.
- Tokens can't touch the sensitive parts. Managing keys and credentials, billing, encryption, household members and data resets only work signed in to the app, never through a token.
- Nobody can move money. The app holds read-only connections to your accounts, so a token can edit your records but can never trade or transfer anything anywhere.
- Revoke any time. Delete a token in the table and it stops working immediately; the Last used column shows whether a token is still in use.