Kepler Developer Portal

Access the Kepler developer portal — API client registration, documentation, and tooling.

Requires a portal grant and a verified GitHub email on an approved domain.

Choose your setup path

Get started with Kepler

Use the API path for scripts and services. Use the MCP path to connect an assistant through the managed MCP gateway.

Get Token

First Call

Agent Runtime

Step 1: Register a Service Client

Create an OAuth client with the scopes you need. Not sure which scopes? Pick a preset below.

Client Name

Selected Scopes

Choose Scopes

Step 2: Get a JWT Token

Exchange your client credentials for a Bearer token. Copy and run this command:

bash

curl -s -X POST https://api.keplr.sh/v1/auth/service-token \
  -H "Content-Type: application/json" \
  -d '{"client_id": "YOUR_CLIENT_ID", "client_secret": "YOUR_SECRET"}'

Then export the token:

bash

export TOKEN="paste-your-access_token-here"

Step 3: Make Your First API Call

Try one of these requests based on your scopes:

Getting a 401 or 403? Check the Diagnostics tab for troubleshooting.

Step 4: Wire an Agent Runtime (Optional)

Use your service client credentials from an agent process. No extra write scope is required.

✓

You're All Set!

Your API client is registered and you've made your first call.

Documentation & API reference Browse endpoints with copy-paste snippets, plus guides on data, schemas, and architecture Diagnostics Troubleshoot auth errors and scope mismatches

Admin

Portal administration

Control who can reach the portal and which model provider Kepler links. Visible to portal admins only.

Access management

Grant or revoke portal access. Accounts must use an @postman.com email; GitHub and super-admin rows are read-only.

GitHub username

Model provider

Link a ChatGPT Codex OAuth session. Tokens stay server-side in AWS Secrets Manager; the portal only handles PKCE login and status. OpenAI opens in a new tab and redirects to http://localhost:1455/auth/callback — keep this tab open during sign-in.

Localhost callback URL

If the OpenAI tab cannot reach localhost after login, copy its full URL here.

Scope & Permission Check

Paste a JWT token or select a client to see its granted scopes and what endpoints are accessible.

JWT Token or Client ID

Integration Smoke Tests

Tests API behavior correctness: rate limit headers, search edge cases, and concurrent request handling.

Try It

Error Troubleshooting

Select the HTTP status code you're seeing to get resolution steps.

Operator Quick Reference

Common operational commands for incident response and debugging. Replace placeholder variables before running.

Kepler Documentation

Select a document from the sidebar to get started.

Credentials

Connect an assistant, or manage clients & keys

Set up a coding assistant over MCP with the steps below, or jump to Clients & keys to mint and manage the OAuth service clients and API keys that authenticate scripts and services. MCP lets Cursor, Claude Code, Codex CLI, or any agent call Kepler tools at mcp.keplr.sh/mcp — accounts, communications, and Salesforce context.

1. Pick an auth mode

Most agents should use service client credentials. The gateway mints a fresh scoped token per request, so no bearer tokens live on disk. Static API keys are simpler for one-off scripts.

2. Get authenticated

Generate credentials for a new MCP client, or find the named client and rotate it because service-client secrets cannot be retrieved.

Client ID

Client Secret

Add to your assistant

Pick your client. Copy and paste this config after credentials are generated or rotated.

Verify connectivity

Run the curl below. Expected: a JSON-RPC response listing the available tools.

Once that returns 200, try a real call:

Clients & keys

Mint and manage the credentials that authenticate non-interactive callers. Service clients are an OAuth client-id and secret pair — the same primitive the MCP setup above issues. API keys are a single X-API-Key string with a custom expiry. Both carry explicit read scopes and can be revoked here.

Service clients

Client name

Scopes

API keys

Scoped X-API-Key credential with a custom expiration. Save it immediately — it cannot be retrieved later.

API key name

Expires at

Scopes

Troubleshooting

401 Unauthorized

Most common cause: stale or wrong client secret. Click Find existing client to locate the named client and rotate it, then restart your assistant. Service-client requests must include both x-kepler-client-id and x-kepler-client-secret.

403 Forbidden on a specific tool

Your principal is missing one of the five read scopes. The Generate flow always issues all five; if you scoped down manually under Clients & keys below, re-mint with all boxes ticked.

429 Too Many Requests

Per-principal rate limit hit. Backoff and retry. See mcp-gateway docs for rate limits and logs.

My client only supports stdio

All currently in-scope clients (Claude Code CLI, Cursor, Codex CLI) speak streamable-http in 2026. If yours genuinely doesn't, see the gateway repo README.

Where do logs go?

Hashed principal, method, status, and timing. Raw API key substrings and client secrets are not logged. See gateway docs.