SDKs and CLI

Use the Keiro package when you want saved credentials and a prompt-first eb1 client. Use an OpenAI-compatible SDK when you are migrating existing application code. Use curl when you need to inspect the raw HTTP contract.

Copy Page https://docs.keirolabs.ai/sdks.md

Keiro Python package and CLI#

Install the package, then run interactive setup:

1
2

python3 -m pip install --upgrade keiro
keiro setup

Setup prompts for the API key, validates it, stores credential metadata in ~/.keiro/credentials, and stores secret bytes in owner-only files under ~/.keiro/secrets/. Later CLI and native-client calls use the saved endpoint and credential.

Run a one-shot prompt:

1

keiro "Explain when to use eb1-preview in two bullets."

Adaptive preview models offer hosted web search by default and leave the decision to the model (tool_choice: "auto"). Use --no-search for a one-shot opt-out, or /search to toggle it in the REPL. Turning search on can change which models are available for a request; use --no-search if a request must run without it.

Or use the native Python facade:

1
2
3

from keiro import models

print(models("eb1-preview", "Explain when to use eb1-preview in two bullets."))

The package does not discover a raw API key from a runtime environment variable. Run keiro setup again to change saved credentials.

List the models available to the saved credential:

1

keiro models

To remove the package and its saved credentials:

1
2

python3 -m pip uninstall keiro
rm -rf ~/.keiro

OpenAI-compatible Python#

Install the SDK:

1

python3 -m pip install --upgrade openai

Prompt for the key and pass it directly to the client:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

from getpass import getpass

from openai import OpenAI

client = OpenAI(
    base_url="https://api.keirolabs.ai/v1",
    api_key=getpass("Keiro API key: "),
)

response = client.responses.create(
    model="eb1-preview",
    input="Say hello in one sentence.",
)

print(response.output_text)

Use this pattern for one-off local scripts. Production services should resolve the key from their approved secret manager and pass it to the SDK constructor.

Generic OpenAI-compatible calls remain explicit: prompt text such as “search the web” does not declare a tool. To offer hosted search, include tools=[{"type": "web_search"}] and tool_choice="auto"; omit the tool (or use the surface's explicit none choice where supported) to opt out. This preserves caller control for compatibility and privacy, while the first-party Keiro CLI and Console apply their documented default themselves.

OpenAI-compatible JavaScript#

Install the SDK and enable ES modules — type=module turns on import syntax and top-level await for the sample below:

1
2

npm install openai
npm pkg set type=module

Save the sample as hello.mjs and run it with node hello.mjs.

Point KEIRO_KEY_FILE at a secret file provisioned by your credential manager. The environment value is a non-secret path, not the key itself:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

import fs from "node:fs";
import OpenAI from "openai";

const keyPath = process.env.KEIRO_KEY_FILE;
if (!keyPath) {
  throw new Error("KEIRO_KEY_FILE must point to a protected secret file");
}

const client = new OpenAI({
  baseURL: "https://api.keirolabs.ai/v1",
  apiKey: fs.readFileSync(keyPath, "utf8").trim(),
});

const response = await client.responses.create({
  model: "eb1-preview",
  input: "Say hello in one sentence.",
});

console.log(response.output_text);

Protect the secret file with the operating system and your deployment platform's secret controls. Do not commit it or place raw secret bytes in a shared .env file.

Curl#

Curl is useful for checking headers and raw response shapes:

1
2
3
4
5
6
7
8

printf 'Keiro API key: '
IFS= read -rs KEIRO_BEARER
printf '\n'

curl -sS https://api.keirolabs.ai/v1/responses \
  -H "Content-Type: application/json" \
  -d '{"model":"eb1-preview","input":"Say hello in one sentence."}' \
  -H @- <<<"Authorization: Bearer $KEIRO_BEARER"

The prompt works in both bash and zsh, and -H @- (curl 7.55 or newer) reads the Authorization header from stdin so the secret never appears in the process argument list.

Local chat UI#

After keiro setup, run:

1

keiro gui

The command starts a local browser chat UI connected to the saved public endpoint and key. It is for chat exploration, not organization, billing, or API-key administration.

Related pages#

• Quickstart
• Agent-driven setup
• Migration
• API reference
• Codex
• Claude Code
• Omnigent
• OpenCode
• Pi