Skip to main content
The public API uses HTTP Bearer Authentication (RFC 6750). Every request needs the token in the Authorization header.

​
The header

Authorization: Bearer kbai_pk_a1b2c3d4e5f6...
  • Format: Bearer <token>. The space between Bearer and the token is required.
  • Send the full token, including the kbai_pk_ prefix.
  • HTTPS is required. Plain HTTP requests are rejected in production.

​
Examples

curl https://api.keebai.com/v1/me \
  -H "Authorization: Bearer kbai_pk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

​
Authentication errors

All auth errors return the same generic status and message — we don’t tell you whether a token is “missing” vs “revoked” to avoid handing enumeration hints to attackers. 
HTTP/1.1 401 Unauthorized
Content-Type: application/json

{
  "message": "Invalid or missing API token",
  "error": "Unauthorized",
  "statusCode": 401
}
Common causes, most frequent first:
CauseFix
Authorization header missing.Add it.
Header set but no Bearer prefix.Include Bearer with a space.
Token mis-copied (truncated, extra whitespace, different charset).Copy from your secret manager again.
Token revoked.Check API Keys. If status is Revoked, mint a new one.
Token expired.Same place — check the Status column.
Token owner deactivated.Ask your tenant admin to reactivate the account.

​
Where to store your token

Secret managers

AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault, 1Password, Doppler. The right answer for production.

GitHub Actions

Repository Settings → Secrets → Actions → New secret. Reference as ${{ secrets.KEEBAI_API_TOKEN }}.

Local .env

Personal dev only. Make sure .env is in .gitignore.

Server env vars

On servers: export KEEBAI_API_TOKEN=.... Never in source code.
Never commit a token to a repository. Never ship one in a mobile app, public SPA, or anything a user can inspect. If you accidentally commit one, revoke it immediately and rewrite your git history if possible.

​
Automatic leak detection

The kbai_pk_ prefix is registered with GitHub’s secret scanning. If a token ends up in a public GitHub repo, you’ll get an alert and we’ll auto-revoke it. To enable secret scanning on your private org repos: GitHub → Settings → Code security → Secret scanning.