Understand
Authentication and API keys
Protect API keys, choose the narrowest scopes, and separate test and live environments.
Bearer authentication
Send the key as a Bearer token in every API request. Live and test keys are environment-bound and cannot be exchanged between environments.
Authorization header
Authorization: Bearer mp_live_...Least-privilege scopes
Create separate keys for each application or automation. Narrow scopes reduce the impact of accidental disclosure and make rotation easier to audit.
- documents.preview for non-persisting previews
- documents.render for final publications
- documents.read for jobs, documents, and artifact links
- documents.delete for managed deletion
- webhooks.read and webhooks.write for delivery configuration
Rotation and storage
Rotate a key before its planned expiry and immediately revoke a key that may have been exposed. Newly revealed secrets are shown once.