Authentication
API keys
Create and revoke the keys your website uses, and send them with each request.
Create an API key
- Step 1: Open Integrations → API and select Create API Key.
- Step 2: Enter a Name of up to 100 characters - name it after the site or system that will use it.
- Step 3: Select Create key, then copy the key from the confirmation and store it somewhere safe.
- Step 4: Select Done.
A key can create orders and contacts, so keep it on your server. Never put it in browser JavaScript, a mobile app or a public repository.
Send the key
Send the key in the X-Api-Key header. An Authorization: Bearer header is accepted as well.
X-Api-Key: mf_your_key
Accept: application/jsonEach successful request updates the key's Last Used time on Integrations → API.
Revoke a key
- Step 1: In the key list, open the key's menu and select Revoke key.
- Step 2: Confirm with Revoke key.
A revoked key gets 401 straight away. Revoking cannot be undone; the key stays in the list marked Revoked.
Who can manage keys
| Permission | Allows |
|---|---|
| API keys → View | Seeing the key list |
| API keys → Create | Creating keys |
| API keys → Manage | Revoking keys |
Permissions are set per role in Workspace → Roles & Permissions.