Authentication

Get an API key, pass it to the API, CLI and MCP server, and read the error responses.

Keenable authenticates with an API key. Log in to obtain one.

Authenticated requests remove the hourly request limit, are rate limited per organization rather than per IP, and report per-call usage back to you. See rate limits for the numbers.

CLI

Run keenable login and follow the browser flow to authenticate. The CLI uses device authorization, so an agent can provide the link for a human to complete.

keenable login

MCP

The easiest way is via the CLI:

# if not authenticated yet
keenable login

keenable configure-mcp --all

This detects supported clients and configures them with your credentials. Alternatively, create an API key in the console and add it manually — see API key header below.

API key header

For manual MCP setup, pass your API key as the X-API-Key header.

Claude Code

claude mcp add keenable \
  --transport http https://api.keenable.ai/mcp \
  --scope user \
  --header "X-API-Key: keen_<your_key>"

Claude Desktop needs that last shape: its config file accepts only local command servers, so a remote "url" entry is ignored without an error. If you don’t need your key applied, skip the file and add Keenable as a connector instead.

Keys are scoped to your workspace, never expire on their own, and can be rotated at any time.

Alternatively, you can pass your API key in the Authorization header using the Bearer scheme. This can be useful when integrating with MCP clients or frameworks that only support bearer tokens.

Authorization: Bearer keen_<your_key>

If both headers are present, X-API-Key takes precedence.

Evaluating without a key

The MCP server, the CLI and the HTTP API all run unauthenticated, so you can try them before creating an account. For the HTTP API this means the /public endpoints described in the API reference, which take no key but require an X-Keenable-Title header naming your application. Unauthenticated requests draw on a shared public pool capped at 1,000 requests per hour and 10 requests per second per IP, and they carry no usage metadata — the _meta["keenable/usage"] block described in the MCP reference is only returned for authenticated calls.

Use an API key for anything beyond a first look: the per-IP pool is shared with everyone else on your network or egress address, so its available headroom is outside your control.

Error responses

Status	Meaning
400	Malformed API key (invalid format)
401	Missing or invalid API key
402	No credits available — the monthly allowance is spent and no purchased credits remain (see credits)
403	API key disabled or revoked
429	Rate limit exceeded