> ## Documentation Index
> Fetch the complete documentation index at: https://docs.keenable.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Get an API key, pass it to the API, CLI and MCP server, and read the error responses.

Keenable authenticates with an API key. [Log in](https://app.keenable.ai/login) to obtain one.

Authenticated requests remove the hourly request limit, are rate limited per organization rather than per IP, and report per-call usage back to you. See [rate limits](/rate-limits) for the numbers.

## CLI

Run `keenable login` and follow the browser flow to authenticate. The CLI uses device authorization, so an agent can provide the link for a human to complete.

```bash theme={"system"}
keenable login
```

## MCP

The easiest way is via the CLI:

```bash theme={"system"}
# if not authenticated yet
keenable login

keenable configure-mcp --all
```

This detects supported clients and configures them with your credentials. Alternatively, create an API key in the [console](https://app.keenable.ai/console) and add it manually — see [API key header](#api-key-header) below.

## API key header

For manual MCP setup, pass your API key as the `X-API-Key` header.

<CodeGroup>
  ```bash Claude Code theme={"system"}
  claude mcp add keenable \
    --transport http https://api.keenable.ai/mcp \
    --scope user \
    --header "X-API-Key: keen_<your_key>"
  ```

  ```toml Codex theme={"system"}
  [mcp_servers.keenable]
  url = "https://api.keenable.ai/mcp"
  http_headers = { "X-API-Key" = "keen_<your_key>" }
  ```

  ```json JSON theme={"system"}
  {
    "mcpServers": {
      "keenable": {
        "url": "https://api.keenable.ai/mcp",
        "headers": {
          "X-API-Key": "keen_<your_key>"
        }
      }
    }
  }
  ```

  ```json Claude Desktop theme={"system"}
  {
    "mcpServers": {
      "keenable": {
        "command": "npx",
        "args": ["-y", "@keenable/mcp-server"],
        "env": {
          "KEENABLE_API_KEY": "keen_<your_key>"
        }
      }
    }
  }
  ```
</CodeGroup>

Claude Desktop needs that last shape: its config file accepts only local `command` servers, so a remote `"url"` entry is ignored without an error. If you don't need your key applied, skip the file and add Keenable as a [connector](/mcp-server#claude-remote-connector) instead.

Keys are scoped to your workspace, never expire on their own, and can be rotated at any time.

Alternatively, you can pass your API key in the `Authorization` header using the `Bearer` scheme. This can be useful when integrating with MCP clients or frameworks that only support bearer tokens.

```http theme={"system"}
Authorization: Bearer keen_<your_key>
```

If both headers are present, `X-API-Key` takes precedence.

## Evaluating without a key

The MCP server, the CLI and the HTTP API all run unauthenticated, so you can try them before creating an account. For the HTTP API this means the `/public` endpoints described in the [API reference](/api-reference#authentication), which take no key but require an `X-Keenable-Title` header naming your application. Unauthenticated requests draw on a shared public pool capped at 1,000 requests per hour and 10 requests per second per IP, and they carry no usage metadata — the `_meta["keenable/usage"]` block described in the [MCP reference](/mcp-server#metadata-for-integrators) is only returned for authenticated calls.

Use an API key for anything beyond a first look: the per-IP pool is shared with everyone else on your network or egress address, so its available headroom is outside your control.

## Error responses

| Status | Meaning                                                                                                         |
| ------ | --------------------------------------------------------------------------------------------------------------- |
| `400`  | Malformed API key (invalid format)                                                                              |
| `401`  | Missing or invalid API key                                                                                      |
| `402`  | No credits available — the monthly allowance is spent and no purchased credits remain (see [credits](/credits)) |
| `403`  | API key disabled or revoked                                                                                     |
| `429`  | Rate limit exceeded                                                                                             |