Read-only API

Authentication

Authenticate the read-only analysis API with a personal Bearer token.

Create an API key#

In the application, open Settings → API keys. Create a token and store it when shown. Use the complete token, including its geo_ prefix.

Send the token#

cURL
curl --fail-with-body 'https://app.keptai.com/api/domains/example.com/agent-analytics?section=overview&days=30' \
  -H "Authorization: Bearer $KEPT_API_TOKEN"

Examples use placeholders. Replace example.com with a domain returned by your project list and set KEPT_API_TOKEN to your personal geo_ token.

Access boundaries#

Bearer tokens authorize GET requests to the agent-analytics and scope-options routes for visible projects. They are not a general-purpose write API. OAuth, public project creation, public prompt writes, and an official SDK are not available. MCP uses the same personal token.

Handle failures#

Status Meaning What to check
400 Invalid host, section, or filter Validate the documented values.
401 Not authenticated Check the Bearer header and whether the token was revoked.
404 Domain not found or not visible Check the host and project access.
502 Scope-options upstream read failed Retry later if appropriate.

Store the token in a server-side environment variable. Never publish it in browser JavaScript or a URL. Revoke unused tokens in Settings.

Search titles, guides, and API references.