> ## Documentation Index
> Fetch the complete documentation index at: https://docs.keebai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Send your Personal Access Token on every request to the Keebai public API, handle 401 errors cleanly, and store tokens safely.

The public API uses **HTTP Bearer Authentication** ([RFC 6750](https://datatracker.ietf.org/doc/html/rfc6750)). Every request needs the token in the `Authorization` header.

## The header

```http theme={null}
Authorization: Bearer kbai_pk_a1b2c3d4e5f6...
```

* Format: `Bearer <token>`. The space between `Bearer` and the token is required.
* Send the full token, including the `kbai_pk_` prefix.
* HTTPS is required. Plain HTTP requests are rejected in production.

## Examples

<CodeGroup>
  ```bash curl theme={null}
  curl https://api.keebai.com/v1/me \
    -H "Authorization: Bearer kbai_pk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  ```

  ```js JavaScript (fetch) theme={null}
  const response = await fetch("https://api.keebai.com/v1/me", {
    headers: {
      Authorization: `Bearer ${process.env.KEEBAI_API_TOKEN}`,
    },
  });
  const data = await response.json();
  ```

  ```ts TypeScript (axios) theme={null}
  import axios from "axios";

  const keebai = axios.create({
    baseURL: "https://api.keebai.com/v1",
    headers: {
      Authorization: `Bearer ${process.env.KEEBAI_API_TOKEN}`,
    },
  });

  const { data } = await keebai.get("/me");
  ```

  ```python Python (requests) theme={null}
  import os
  import requests

  response = requests.get(
      "https://api.keebai.com/v1/me",
      headers={"Authorization": f"Bearer {os.environ['KEEBAI_API_TOKEN']}"},
      timeout=10,
  )
  response.raise_for_status()
  data = response.json()
  ```

  ```go Go theme={null}
  package main

  import (
      "io"
      "net/http"
      "os"
  )

  func main() {
      req, _ := http.NewRequest("GET", "https://api.keebai.com/v1/me", nil)
      req.Header.Set("Authorization", "Bearer "+os.Getenv("KEEBAI_API_TOKEN"))
      resp, err := http.DefaultClient.Do(req)
      if err != nil { panic(err) }
      defer resp.Body.Close()
      io.Copy(os.Stdout, resp.Body)
  }
  ```
</CodeGroup>

## Authentication errors

All auth errors return the same generic status and message — we don't tell you whether a token is "missing" vs "revoked" to avoid handing enumeration hints to attackers.

```http theme={null}
HTTP/1.1 401 Unauthorized
Content-Type: application/json
```

```json theme={null}
{
  "message": "Invalid or missing API token",
  "error": "Unauthorized",
  "statusCode": 401
}
```

Common causes, most frequent first:

| Cause                                                              | Fix                                                                                                        |
| ------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------- |
| `Authorization` header missing.                                    | Add it.                                                                                                    |
| Header set but no `Bearer ` prefix.                                | Include `Bearer ` with a space.                                                                            |
| Token mis-copied (truncated, extra whitespace, different charset). | Copy from your secret manager again.                                                                       |
| Token revoked.                                                     | Check [API Keys](https://app.keebai.com/system-settings/api-keys). If status is `Revoked`, mint a new one. |
| Token expired.                                                     | Same place — check the *Status* column.                                                                    |
| Token owner deactivated.                                           | Ask your tenant admin to reactivate the account.                                                           |

## Where to store your token

<CardGroup cols={2}>
  <Card title="Secret managers" icon="vault">
    AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault, 1Password, Doppler. The right answer for production.
  </Card>

  <Card title="GitHub Actions" icon="github">
    Repository Settings → Secrets → Actions → New secret. Reference as `${{ secrets.KEEBAI_API_TOKEN }}`.
  </Card>

  <Card title="Local .env" icon="file">
    Personal dev only. Make sure `.env` is in `.gitignore`.
  </Card>

  <Card title="Server env vars" icon="terminal">
    On servers: `export KEEBAI_API_TOKEN=...`. Never in source code.
  </Card>
</CardGroup>

<Warning>
  **Never** commit a token to a repository. **Never** ship one in a mobile app, public SPA, or anything a user can inspect. If you accidentally commit one, [revoke it immediately](/dev/api-keys#revoke-a-token) and rewrite your git history if possible.
</Warning>

## Automatic leak detection

The `kbai_pk_` prefix is registered with GitHub's secret scanning. If a token ends up in a public GitHub repo, you'll get an alert and we'll auto-revoke it.

To enable secret scanning on your private org repos: GitHub → Settings → Code security → Secret scanning.