> For the complete documentation index, see [llms.txt](https://ovion-studio.gitbook.io/keryo-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ovion-studio.gitbook.io/keryo-docs/developers/overview.md).

# Overview

Build on Keryo with the REST API and the MCP connector — auth, scopes, and base URLs.

Keryo exposes its functionality to code in two complementary ways: a **REST API** for direct programmatic access, and an **MCP connector** that lets AI clients (such as Claude) drive Keryo through natural language. Both are built on the same backend, enforce the same scopes, and respect the same plan gating as the web app.

## Base URL

| Environment | Base URL                |
| ----------- | ----------------------- |
| Production  | `https://api.keryo.io`  |
| Development | `http://localhost:3001` |

All REST paths in this documentation are relative to the base URL above. For example, `GET /posts` in production means `GET https://api.keryo.io/posts`.

## Authentication methods

There are two ways to authenticate a programmatic request:

| Method                      | Used by                                   | Format                                 |
| --------------------------- | ----------------------------------------- | -------------------------------------- |
| **API keys**                | Server-to-server scripts and integrations | `Authorization: Bearer <api-key>`      |
| **OAuth 2.1 access tokens** | The MCP connector                         | `Authorization: Bearer <access-token>` |

Both are **scoped** — a token can only perform the actions its scopes allow. See [Authentication](/keryo-docs/developers/authentication.md) for how to create and use API keys, and [MCP connector](/keryo-docs/developers/mcp-connector.md) for the OAuth 2.1 flow.

{% hint style="info" %}
**Cookie sessions have full access.** When you're signed in to the web app, your requests use a cookie/JWT session that carries **no scopes** and has full access. Scopes only apply to API keys and OAuth 2.1 access tokens.
{% endhint %}

## Plan gating still applies

Scopes decide *what an action is*, but your **plan tier** still decides *whether you can do it*. Even with the right scope, a scoped token is subject to the same plan limits as the web app:

* **Importing posts** requires **Freelance** or higher.
* **Statistics** require **Studio** or higher.

If a token has the correct scope but the account's plan is too low, the request is rejected. See [Rate limits & errors](/keryo-docs/developers/rate-limits-and-errors.md).

## Where to go next

* [Authentication](/keryo-docs/developers/authentication.md) — create API keys and understand the scope list.
* [API reference](/keryo-docs/developers/api-reference.md) — endpoints by resource, with example requests.
* [MCP connector](/keryo-docs/developers/mcp-connector.md) — the Keryo MCP server and its tools.
* [Rate limits & errors](/keryo-docs/developers/rate-limits-and-errors.md) — error semantics and rate limiting.