Authentication

The public API uses HTTP Bearer Authentication (RFC 6750). Every request needs the token in the Authorization header.

The header

Authorization: Bearer kbai_pk_a1b2c3d4e5f6...

Format: Bearer <token>. The space between Bearer and the token is required.
Send the full token, including the kbai_pk_ prefix.
HTTPS is required. Plain HTTP requests are rejected in production.

Examples

curl https://api.keebai.com/v1/me \
  -H "Authorization: Bearer kbai_pk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

const response = await fetch("https://api.keebai.com/v1/me", {
  headers: {
    Authorization: `Bearer ${process.env.KEEBAI_API_TOKEN}`,
  },
});
const data = await response.json();

import axios from "axios";

const keebai = axios.create({
  baseURL: "https://api.keebai.com/v1",
  headers: {
    Authorization: `Bearer ${process.env.KEEBAI_API_TOKEN}`,
  },
});

const { data } = await keebai.get("/me");

import os
import requests

response = requests.get(
    "https://api.keebai.com/v1/me",
    headers={"Authorization": f"Bearer {os.environ['KEEBAI_API_TOKEN']}"},
    timeout=10,
)
response.raise_for_status()
data = response.json()

package main

import (
    "io"
    "net/http"
    "os"
)

func main() {
    req, _ := http.NewRequest("GET", "https://api.keebai.com/v1/me", nil)
    req.Header.Set("Authorization", "Bearer "+os.Getenv("KEEBAI_API_TOKEN"))
    resp, err := http.DefaultClient.Do(req)
    if err != nil { panic(err) }
    defer resp.Body.Close()
    io.Copy(os.Stdout, resp.Body)
}

Authentication errors

All auth errors return the same generic status and message — we don’t tell you whether a token is “missing” vs “revoked” to avoid handing enumeration hints to attackers.

HTTP/1.1 401 Unauthorized
Content-Type: application/json

{
  "message": "Invalid or missing API token",
  "error": "Unauthorized",
  "statusCode": 401
}

Common causes, most frequent first:

Cause	Fix
`Authorization` header missing.	Add it.
Header set but no `Bearer` prefix.	Include `Bearer` with a space.
Token mis-copied (truncated, extra whitespace, different charset).	Copy from your secret manager again.
Token revoked.	Check API Keys. If status is `Revoked`, mint a new one.
Token expired.	Same place — check the Status column.
Token owner deactivated.	Ask your tenant admin to reactivate the account.

Where to store your token

Secret managers

AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault, 1Password, Doppler. The right answer for production.

GitHub Actions

Repository Settings → Secrets → Actions → New secret. Reference as ${{ secrets.KEEBAI_API_TOKEN }}.

Local .env

Personal dev only. Make sure .env is in .gitignore.

Server env vars

On servers: export KEEBAI_API_TOKEN=.... Never in source code.

Never commit a token to a repository. Never ship one in a mobile app, public SPA, or anything a user can inspect. If you accidentally commit one, revoke it immediately and rewrite your git history if possible.

Automatic leak detection

The kbai_pk_ prefix is registered with GitHub’s secret scanning. If a token ends up in a public GitHub repo, you’ll get an alert and we’ll auto-revoke it. To enable secret scanning on your private org repos: GitHub → Settings → Code security → Secret scanning.

Get started

Authentication

MCP

SDK

CLI

Agent Skills

Limits

Authentication

The header

Examples

Authentication errors

Where to store your token

Secret managers

GitHub Actions

Local .env

Server env vars

Automatic leak detection

​The header

​Examples

​Authentication errors

​Where to store your token

Secret managers

GitHub Actions

Local .env

Server env vars

​Automatic leak detection

The header

Examples

Authentication errors

Where to store your token

Automatic leak detection