The Keupera Public API gives you programmatic access to every major platform module: Keyword Research, Backlink Research, Content Management, AI Visibility, and Analytics.
Base URL
All endpoints live under a single host, grouped by module function name:
https://app.keupera.com/api/v1/<function-name>
| Module | Function |
|---|
| Keywords | public-api-keywords |
| Backlinks | public-api-backlinks |
| Content | public-api-content |
| AI Visibility | public-api-ai-visibility |
| Analytics | public-api-analytics |
Authentication
Every request must include your API key as a Bearer token:
Authorization: Bearer YOUR_KEUPERA_API_KEY
Your subscription plan must include Public API access. Requests from plans without API entitlement return 403 Forbidden.
Common query parameters
Most endpoints accept:
| Parameter | Type | Default | Description |
|---|
website_id | UUID | API key’s website | Override the target website |
limit | integer | varies per endpoint | Number of results to return |
page | integer | 1 | Page number for paginated endpoints |
Date range parameters
Analytics and Search Console endpoints accept date ranges:
| Parameter | Type | Default | Description |
|---|
range | string | 30d | Preset: 7d, 30d, 90d |
from | string | — | Start date (YYYY-MM-DD) |
to | string | — | End date (YYYY-MM-DD) |
When both from and to are provided, range is ignored.
Success
{
"data": [ /* ... */ ],
"meta": {
"total": 150,
"page": 1,
"limit": 20
}
}
Error
{ "error": "Descriptive error message" }
HTTP status codes
| Code | Meaning |
|---|
200 | Success |
201 | Created |
400 | Bad request — missing or invalid parameters |
401 | Unauthorized — missing or invalid API key |
403 | Forbidden — inactive key, no API access, or unauthorized website |
404 | Not found |
429 | Too many requests — rate limit exceeded |
500 | Internal server error |
Rate limits
Requests are rate-limited per subscription tier. If you exceed your quota you’ll receive 429 Too Many Requests. Contact ask@support.keupera.com to request a higher limit.
CORS
All endpoints respond with Access-Control-Allow-Origin: * so they can be called from any origin — but never ship a key in a browser; always proxy requests through your own backend. 
