Every public /v1 endpoint requires a Mansa API key in the Authorization header.
Authorization: Bearer your_mansa_api_keyCreate and store a key
Open API keys, create a named key, and copy the secret before closing the dialog. The full secret is shown only once. Create a replacement if you lose it.
Use an environment variable or a secret manager on your server. Never include the key in browser bundles, mobile applications, public repositories, or URLs.
Each platform secret begins with msk_live_. Create separate named keys for different apps so you can rotate or revoke one without affecting the others.
If you used Mansa web before the developer platform, you may also have a legacy key (MT_API…). Legacy keys still authenticate on /v1/* and appear under Legacy keys on the API keys page. Prefer creating a new platform key for new integrations.
Rotate a key
- Create a new key.
- Update your application's secret and verify a request.
- Revoke the old key after its callers have moved.
Revocation is permanent. Existing integrations using that key will stop authenticating.
Console sign in
Sign in to the console with your Mansa account to manage keys, billing, and usage. API requests authenticate with your Mansa key only.
Missing credentials return 401 with context unauthorized. An unknown or revoked key returns 401 with context invalid_api_key. See Errors.