Platform API Authentication

From Dashboard → Settings → API Keys, click "Generate Key." Give it a descriptive label (e.g. "Production backend") and choose a scope if prompted. The key is shown once — copy it immediately and store it somewhere secure.

• →Production keys are prefixed mk_live_; sandbox/testing keys are prefixed mk_test_
• →Create separate keys per environment or integration so you can revoke one without affecting others

Pass your API key as a Bearer token in the Authorization header on every request: Authorization: Bearer mk_live_xxxxxxxxxxxx. All endpoints require HTTPS and return JSON.

• →Never expose a live API key in client-side/browser code — always call the API from a server you control
• →Rotate a key immediately from the dashboard if you suspect it has leaked

Rate limits scale with your plan — from 100 requests/day on Free up to unlimited on Agency. Every response includes X-RateLimit-Remaining and X-RateLimit-Reset headers so you can track your usage without guessing.

• →Exceeding your limit returns a 429 Too Many Requests response — back off and retry after the reset time
• →Build retry logic with exponential backoff for production integrations to handle transient limits gracefully

The API returns standard HTTP status codes — 4xx for client errors (bad input, auth failures) and 5xx for server errors. Every error response includes a JSON body with an error field describing what went wrong in plain language.

• →422 responses include the specific validation error — check the error field rather than assuming generic invalid input
• →Log the full response body during development; it's the fastest way to debug integration issues