Overview

Build on Keryo with the REST API and the MCP connector — auth, scopes, and base URLs.

Keryo exposes its functionality to code in two complementary ways: a REST API for direct programmatic access, and an MCP connector that lets AI clients (such as Claude) drive Keryo through natural language. Both are built on the same backend, enforce the same scopes, and respect the same plan gating as the web app.

Base URL

Environment	Base URL
Production	https://api.keryo.io
Development	http://localhost:3001

All REST paths in this documentation are relative to the base URL above. For example, GET /posts in production means GET https://api.keryo.io/posts.

Authentication methods

There are two ways to authenticate a programmatic request:

Method	Used by	Format
API keys	Server-to-server scripts and integrations	Authorization: Bearer <api-key>
OAuth 2.1 access tokens	The MCP connector	Authorization: Bearer <access-token>

Both are scoped — a token can only perform the actions its scopes allow. See Authentication for how to create and use API keys, and MCP connector for the OAuth 2.1 flow.

Cookie sessions have full access. When you're signed in to the web app, your requests use a cookie/JWT session that carries no scopes and has full access. Scopes only apply to API keys and OAuth 2.1 access tokens.

Plan gating still applies

Scopes decide what an action is, but your plan tier still decides whether you can do it. Even with the right scope, a scoped token is subject to the same plan limits as the web app:

• Importing posts requires Freelance or higher.

• Statistics require Studio or higher.

If a token has the correct scope but the account's plan is too low, the request is rejected. See Rate limits & errors.

Where to go next

• Authentication — create API keys and understand the scope list.

• API reference — endpoints by resource, with example requests.

• MCP connector — the Keryo MCP server and its tools.

• Rate limits & errors — error semantics and rate limiting.