Authentication

The public API uses HTTP Bearer Authentication (RFC 6750). Every request needs the token in the Authorization header.

The header

Authorization: Bearer kbai_pk_a1b2c3d4e5f6...

Format: Bearer <token>. The space between Bearer and the token is required.
Send the full token, including the kbai_pk_ prefix.
HTTPS is required. Plain HTTP requests are rejected in production.

The token decides the tenant

Authorization is the only header that determines which company and project your request touches. Both are resolved from the token server-side, on every request, and neither is overridable by the caller.

Never send company, company_id, or project — not in a body, not in a query string, not as a header. There is no x-company header on the public API. Sending any of them returns 400, because endpoints reject properties they do not declare rather than ignoring them.This is deliberate. If tenancy were something the caller could assert, a leaked token would be a leaked platform, not a leaked project. Failing loudly on the attempt is what keeps a mistake in your code from becoming a cross-tenant write.

They are absent from responses too. Records come back without tenant identifiers, so a payload you log or forward carries nothing about which company produced it.

Snippets that pass company in a header or a body come from Keebai’s internal service-to-service calls, which run on a private network and predate the public surface. They do not apply here — if you inherited one, drop the header and mint a token instead.

To see which company and project your token resolves to, call GET /v1/me.

Examples

curl https://api.keebai.com/v1/me \
  -H "Authorization: Bearer kbai_pk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

const response = await fetch("https://api.keebai.com/v1/me", {
  headers: {
    Authorization: `Bearer ${process.env.KEEBAI_API_TOKEN}`,
  },
});
const data = await response.json();

import axios from "axios";

const keebai = axios.create({
  baseURL: "https://api.keebai.com/v1",
  headers: {
    Authorization: `Bearer ${process.env.KEEBAI_API_TOKEN}`,
  },
});

const { data } = await keebai.get("/me");

import os
import requests

response = requests.get(
    "https://api.keebai.com/v1/me",
    headers={"Authorization": f"Bearer {os.environ['KEEBAI_API_TOKEN']}"},
    timeout=10,
)
response.raise_for_status()
data = response.json()

package main

import (
    "io"
    "net/http"
    "os"
)

func main() {
    req, _ := http.NewRequest("GET", "https://api.keebai.com/v1/me", nil)
    req.Header.Set("Authorization", "Bearer "+os.Getenv("KEEBAI_API_TOKEN"))
    resp, err := http.DefaultClient.Do(req)
    if err != nil { panic(err) }
    defer resp.Body.Close()
    io.Copy(os.Stdout, resp.Body)
}

Authentication errors

All auth errors return the same generic status and message — we don’t tell you whether a token is “missing” vs “revoked” to avoid handing enumeration hints to attackers.

HTTP/1.1 401 Unauthorized
Content-Type: application/json

{
  "message": "Invalid or missing API token",
  "error": "Unauthorized",
  "statusCode": 401
}

Common causes, most frequent first:

Cause	Fix
`Authorization` header missing.	Add it.
Header set but no `Bearer` prefix.	Include `Bearer` with a space.
Token mis-copied (truncated, extra whitespace, different charset).	Copy from your secret manager again.
Token revoked.	Check API Keys. If status is `Revoked`, mint a new one.
Token expired.	Same place — check the Status column.
Token owner deactivated.	Ask your tenant admin to reactivate the account.

Where to store your token

Secret managers

AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault, 1Password, Doppler. The right answer for production.

GitHub Actions

Repository Settings → Secrets → Actions → New secret. Reference as ${{ secrets.KEEBAI_API_TOKEN }}.

Local .env

Personal dev only. Make sure .env is in .gitignore.

Server env vars

On servers: export KEEBAI_API_TOKEN=.... Never in source code.

Never commit a token to a repository. Never ship one in a mobile app, public SPA, or anything a user can inspect. If you accidentally commit one, revoke it immediately and rewrite your git history if possible.

Automatic leak detection

The kbai_pk_ prefix is registered with GitHub’s secret scanning. If a token ends up in a public GitHub repo, you’ll get an alert and we’ll auto-revoke it. To enable secret scanning on your private org repos: GitHub → Settings → Code security → Secret scanning.

Get started

Authentication

MCP

SDK

CLI

Agent Skills

Limits

Authentication

The header

The token decides the tenant

Examples

Authentication errors

Where to store your token

Secret managers

GitHub Actions

Local .env

Server env vars

Automatic leak detection

​The header

​The token decides the tenant

​Examples

​Authentication errors

​Where to store your token

Secret managers

GitHub Actions

Local .env

Server env vars

​Automatic leak detection

The header

The token decides the tenant

Examples

Authentication errors

Where to store your token

Automatic leak detection