Authentication
Authenticate the read-only analysis API with a personal Bearer token.
Create an API key#
In the application, open Settings → API keys. Create a token and store it when shown. Use the complete token, including its geo_ prefix.
Send the token#
curl --fail-with-body 'https://app.keptai.com/api/domains/example.com/agent-analytics?section=overview&days=30' \
-H "Authorization: Bearer $KEPT_API_TOKEN"
const response = await fetch(
'https://app.keptai.com/api/domains/example.com/agent-analytics?section=overview&days=30',
{ headers: { Authorization: `Bearer ${process.env.KEPT_API_TOKEN}` } }
);
if (!response.ok) throw new Error(`HTTP ${response.status}`);
const data = await response.json();
console.log(data);
import json, os, urllib.request
request = urllib.request.Request(
'https://app.keptai.com/api/domains/example.com/agent-analytics?section=overview&days=30',
headers={'Authorization': 'Bearer ' + os.environ['KEPT_API_TOKEN']}
)
with urllib.request.urlopen(request) as response:
print(json.load(response))
Examples use placeholders. Replace example.com with a domain returned by your project list and set KEPT_API_TOKEN to your personal geo_ token.
Access boundaries#
Bearer tokens authorize GET requests to the agent-analytics and scope-options routes for visible projects. They are not a general-purpose write API. OAuth, public project creation, public prompt writes, and an official SDK are not available. MCP uses the same personal token.
Handle failures#
| Status | Meaning | What to check |
|---|---|---|
| 400 | Invalid host, section, or filter | Validate the documented values. |
| 401 | Not authenticated | Check the Bearer header and whether the token was revoked. |
| 404 | Domain not found or not visible | Check the host and project access. |
| 502 | Scope-options upstream read failed | Retry later if appropriate. |
Store the token in a server-side environment variable. Never publish it in browser JavaScript or a URL. Revoke unused tokens in Settings.