Kepler Developer Portal

Access the Kepler developer portal — API client registration, documentation, and tooling.

Requires a portal grant and a verified GitHub email on an approved domain.

Choose your setup path

Get started with Kepler

Use the API path for scripts and services. Use the MCP path to connect an assistant through the managed MCP gateway.

Get Token

First Call

Agent Runtime

Step 1: Register a Service Client

Create an OAuth client with the scopes you need. Not sure which scopes? Pick a preset below.

Client Name

Selected Scopes

Choose Scopes

Step 2: Get a JWT Token

Exchange your client credentials for a Bearer token. Copy and run this command:

bash

curl -s -X POST https://api.kepler.rip/v1/auth/service-token \
  -H "Content-Type: application/json" \
  -d '{"client_id": "YOUR_CLIENT_ID", "client_secret": "YOUR_SECRET"}'

Then export the token:

bash

export TOKEN="paste-your-access_token-here"

Step 3: Make Your First API Call

Try one of these requests based on your scopes:

Getting a 401 or 403? Check the Diagnostics tab for troubleshooting.

Step 4: Wire an Agent Runtime (Optional)

Use your service client credentials from an agent process. No extra write scope is required.

✓

You're All Set!

Your API client is registered and you've made your first call.

API Explorer Browse all endpoints with copy-paste snippets Documentation Deep-dive docs on data, schemas, and architecture Diagnostics Troubleshoot auth errors and scope mismatches

Features

What Kepler provides for agent builders and platform consumers. Every feature below is backed by live infrastructure, tests, and documentation.

Mint New Service Client

Client Name

Scopes

My Service Clients

Mint New API Key

Create a scoped `X-API-Key` credential with a custom expiration. Save it immediately — it cannot be retrieved later.

API Key Name

Expires At

Scopes

My API Keys

Grant Portal Access

Account must be associated with an @postman.com email domain.

GitHub Username

Access Directory

Search all known portal grants. Portal allowlist rows can be removed here; GitHub and super-admin rows are read-only.

Admin model provider

Link OpenAI Codex

Connect a ChatGPT Codex OAuth session to Kepler. Tokens stay server-side in AWS Secrets Manager; the portal only handles PKCE login and status.

OpenAI opens in a new tab and redirects this Codex client to http://localhost:1455/auth/callback. Keep this tab open during sign-in.

Localhost callback URL

If the OpenAI tab cannot reach localhost after login, copy its full URL here.

Codex Link Status

Cerebras remains the default for ask_communications. Codex is linked here for explicit future routing and graph enrichment.

Endpoints

Select an endpoint from the sidebar to see scoped curl snippets.

Scope & Permission Check

Paste a JWT token or select a client to see its granted scopes and what endpoints are accessible.

JWT Token or Client ID

Integration Smoke Tests

Tests API behavior correctness: rate limit headers, search edge cases, and concurrent request handling.

For uptime monitoring, use the Platform Status tab.

Try It

Error Troubleshooting

Select the HTTP status code you're seeing to get resolution steps.

Operator Quick Reference

Common operational commands for incident response and debugging. Replace placeholder variables before running.

API Health

Live health check against /v1/health. Auto-refreshes every 30 seconds.

Checking...

SLO Dashboard

Service Level Objectives and current status. Click "Run Checks" to measure live latency against targets.

Error Budget Policy

Budget Consumed	Action
< 50%	Normal operations. Deploy freely.
50–75%	Reduce deploy frequency. Prioritize reliability.
75–90%	Feature freeze. Only reliability and bug fixes.
> 90%	Incident mode. All hands on reliability.

Kepler Documentation

Select a document from the sidebar to get started.

Connect Kepler to your coding assistant

MCP lets Cursor, Claude Code, Codex CLI, or any agent call Kepler tools directly. This page configures the high-level Kepler surface at mcp.kepler.rip/mcp — accounts, communications, and Salesforce context.

1. Pick an auth mode

Most agents should use service client credentials. The gateway mints a fresh scoped token per request, so no bearer tokens live on disk. Static API keys are simpler for one-off scripts.

2. Get authenticated

Generate credentials for a new MCP client, or find the named client and rotate it because service-client secrets cannot be retrieved.

Client ID

Client Secret

Add to your assistant

Pick your client. Copy and paste this config after credentials are generated or rotated.

Verify connectivity

Run the curl below. Expected: a JSON-RPC response listing the available tools.

Once that returns 200, try a real call:

Troubleshooting

401 Unauthorized

Most common cause: stale or wrong client secret. Click Find existing client to locate the named client and rotate it, then restart your assistant. Service-client requests must include both x-kepler-client-id and x-kepler-client-secret.

403 Forbidden on a specific tool

Your principal is missing one of the five read scopes. The Generate flow always issues all five; if you scoped down manually on the Access tab, return there and tick the boxes.

429 Too Many Requests

Per-principal rate limit hit. Backoff and retry. See mcp-gateway docs for rate limits and logs.

My client only supports stdio

All currently in-scope clients (Claude Code CLI, Cursor, Codex CLI) speak streamable-http in 2026. If yours genuinely doesn't, see the gateway repo README.

Where do logs go?

Hashed principal, method, status, and timing. Raw API key substrings and client secrets are not logged. See gateway docs.