> Keiro Labs API documentation - SDKs and CLI
> Page: https://docs.keirolabs.ai/sdks.html
> Markdown: https://docs.keirolabs.ai/sdks.md
> Agent index: https://docs.keirolabs.ai/llms.txt
> API base URL: https://api.keirolabs.ai/v1
> Auth: send "Authorization: Bearer <api-key>" with a key created in the
> Keiro console (https://console.keirolabs.ai/api-keys). Use credentials saved by
> `keiro setup`, or resolve the key from a secret manager or an owner-only
> secret file and pass it to the client explicitly. Never read another
> provider's variable, and never put raw key material in environment
> variables, code, docs, or logs.

# SDKs and CLI

Use the Keiro package when you want saved credentials and a prompt-first eb1
client. Use an OpenAI-compatible SDK when you are migrating existing
application code. Use curl when you need to inspect the raw HTTP contract.

## Keiro Python package and CLI

Install the package, then run interactive setup:

```bash
python3 -m pip install --upgrade keiro
keiro setup
```

Setup prompts for the API key, validates it, stores credential metadata in
`~/.keiro/credentials`, and stores secret bytes in owner-only files under
`~/.keiro/secrets/`. Later CLI and native-client calls use the saved endpoint
and credential.

Run a one-shot prompt:

```bash
keiro "Explain when to use eb1-preview in two bullets."
```

Adaptive preview models offer hosted web search by default and leave the
decision to the model (`tool_choice: "auto"`). Use `--no-search` for a one-shot
opt-out, or `/search` to toggle it in the REPL. Turning search on can change
which models are available for a request; use `--no-search` if a request must
run without it.

Or use the native Python facade:

```python
from keiro import models

print(models("eb1-preview", "Explain when to use eb1-preview in two bullets."))
```

The package does not discover a raw API key from a runtime environment
variable. Run `keiro setup` again to change saved credentials.

List the models available to the saved credential:

```bash
keiro models
```

To remove the package and its saved credentials:

```bash
python3 -m pip uninstall keiro
rm -rf ~/.keiro
```

## OpenAI-compatible Python

Install the SDK:

```bash
python3 -m pip install --upgrade openai
```

Prompt for the key and pass it directly to the client:

```python
from getpass import getpass

from openai import OpenAI

client = OpenAI(
    base_url="https://api.keirolabs.ai/v1",
    api_key=getpass("Keiro API key: "),
)

response = client.responses.create(
    model="eb1-preview",
    input="Say hello in one sentence.",
)

print(response.output_text)
```

Use this pattern for one-off local scripts. Production services should resolve
the key from their approved secret manager and pass it to the SDK constructor.

Generic OpenAI-compatible calls remain explicit: prompt text such as “search the
web” does not declare a tool. To offer hosted search, include
`tools=[{"type": "web_search"}]` and `tool_choice="auto"`; omit the tool (or use
the surface's explicit `none` choice where supported) to opt out. This preserves
caller control for compatibility and privacy, while the first-party Keiro CLI and
Console apply their documented default themselves.

## OpenAI-compatible JavaScript

Install the SDK and enable ES modules — `type=module` turns on `import`
syntax and top-level `await` for the sample below:

```bash
npm install openai
npm pkg set type=module
```

Save the sample as `hello.mjs` and run it with `node hello.mjs`.

Point `KEIRO_KEY_FILE` at a secret file provisioned by your credential
manager. The environment value is a non-secret path, not the key itself:

```javascript
import fs from "node:fs";
import OpenAI from "openai";

const keyPath = process.env.KEIRO_KEY_FILE;
if (!keyPath) {
  throw new Error("KEIRO_KEY_FILE must point to a protected secret file");
}

const client = new OpenAI({
  baseURL: "https://api.keirolabs.ai/v1",
  apiKey: fs.readFileSync(keyPath, "utf8").trim(),
});

const response = await client.responses.create({
  model: "eb1-preview",
  input: "Say hello in one sentence.",
});

console.log(response.output_text);
```

Protect the secret file with the operating system and your deployment
platform's secret controls. Do not commit it or place raw secret bytes in a
shared `.env` file.

## Curl

Curl is useful for checking headers and raw response shapes:

```bash
printf 'Keiro API key: '
IFS= read -rs KEIRO_BEARER
printf '\n'

curl -sS https://api.keirolabs.ai/v1/responses \
  -H "Content-Type: application/json" \
  -d '{"model":"eb1-preview","input":"Say hello in one sentence."}' \
  -H @- <<<"Authorization: Bearer $KEIRO_BEARER"
```

The prompt works in both bash and zsh, and `-H @-` (curl 7.55 or newer) reads
the Authorization header from stdin so the secret never appears in the process
argument list.

## Local chat UI

After `keiro setup`, run:

```bash
keiro gui
```

The command starts a local browser chat UI connected to the saved public
endpoint and key. It is for chat exploration, not organization, billing, or
API-key administration.

## Related pages

- [Quickstart](quickstart.md)
- [Agent-driven setup](agent-setup.md)
- [Migration](migration.md)
- [API reference](api-reference.md)
- [Codex](codex.md)
- [Claude Code](claude-code.md)
- [Omnigent](omnigent.md)
- [OpenCode](opencode.md)
- [Pi](pi.md)