> Keiro Labs API documentation - Authentication
> Page: https://docs.keirolabs.ai/api-auth.html
> Markdown: https://docs.keirolabs.ai/api-auth.md
> Agent index: https://docs.keirolabs.ai/llms.txt
> API base URL: https://api.keirolabs.ai/v1
> Auth: send "Authorization: Bearer <api-key>" with a key created in the
> Keiro console (https://console.keirolabs.ai/api-keys). Use credentials saved by
> `keiro setup`, or resolve the key from a secret manager or an owner-only
> secret file and pass it to the client explicitly. Never read another
> provider's variable, and never put raw key material in environment
> variables, code, docs, or logs.

# API auth

Keiro uses organization API keys for public API requests. Send the key as an
HTTP bearer token:

```text
Authorization: Bearer <api-key>
```

Console sessions authenticate the browser console; they are not API keys and
must not be copied into an application.

## Create a key in the console

Owners, admins, and developers create named keys from
[API Keys](https://console.keirolabs.ai/api-keys). The full secret appears once
after creation. Store it before closing the reveal because the console cannot
show it again.

See [API keys](api-keys.md) for ownership, staged replacement, and revocation.

## Verify bearer authentication

Make a harmless model-list request. The prompt reads the key without echoing
it, and curl takes the Authorization header from stdin, so the secret stays
out of the environment, the process argument list, and shell history:

```bash
printf 'Keiro API key: '
IFS= read -rs KEIRO_BEARER
printf '\n'

curl -sS https://api.keirolabs.ai/v1/models \
  -H @- <<<"Authorization: Bearer $KEIRO_BEARER" | python3 -m json.tool
```

A successful response confirms the key and base URL. It does not guarantee
that every model or capability is enabled; the returned model list is
account-scoped.

## Use the right credential

Use an ordinary organization API key when testing customer response shapes.
Operator or diagnostic credentials are not application credentials and can
expose different behavior that public clients must not depend on.

Use a separate key for each deployment or tool. Never share one key across
unrelated production, development, and personal workflows.

## Handle auth failures

- `401` means the bearer token is missing, invalid, expired, or revoked.
- `403` means authentication succeeded but the key or organization is not
  allowed to perform the operation.
- A missing model from `GET /v1/models` is an access or policy issue, not a
  reason to use an internal model name.

Support does not need the secret. Send a request ID, timestamp, endpoint,
public model ID, HTTP status, and the key's non-secret name or tracking
identifier.

## Related pages

- [API keys](api-keys.md)
- [Quickstart](quickstart.md)
- [Errors](errors.md)
- [Data retention](data-retention.md)
- [Status and support](status-support.md)