Authentication
Use scoped Bearer keys, rotate them safely and keep secrets off the client.
Bearer authentication
Send the API key in every request as Authorization: Bearer <key>. Session cookies work in the dashboard, but integrations and server jobs should use keys.
Authorization: Bearer ms_live_your_secret_keyKey scopes
| Scope | Access | Use it for |
|---|---|---|
organization | All resources in one organization | Trusted backend services |
domain | Links and analytics for one domain | Campaign tools and AI assistants |
create_only | Create links without reading the library | Public forms and low-trust integrations |
read_only | Read links and analytics | Dashboards, BI and reporting |
Domain keys cannot manage workspace credentials, subscriptions or organization-wide bulk jobs. Use an organization key for those operations. Domain-key create and list requests default to the authorized domain.
Key lifecycle
- Name a key after the system that owns it.
- Choose the smallest useful scope and an expiry.
- Store it in a secret manager or environment variable.
- Rotate before expiry and revoke the previous key after rollout.
A key is a password.Never embed a secret key in browser JavaScript, a mobile binary, a public repository or a screenshot.