Keys and scopes
Send your key in the Authorization header with every request.
curl https://api.messgeo.com/v1/me -H "Authorization: Bearer mgk_xxxxxxxxxx_your_secret"A key in the address is refused with 401 key_in_query. Keys are stored only as a hash, so we cannot show one again.
Scopes
| Scope | Allows | Packages |
|---|---|---|
account:read | Account, balance, usage, tool list | All |
account:write | Mail preferences | Starter, Pro |
tools:read | Earlier tool runs | All |
tools:run | Run tools, spends credits | All |
tools:orders | Premium report orders | All |
pt:read | Read Prompt Tracking data | Starter, Pro |
pt:write | Create and manage panels, prompts, competitors, settings, share links | Pro |
What a key can do is what you granted it and what your package allows today. If your package changes, the key follows without any action.
Expiry
Choose 30, 90 or 365 days, or no expiry. We remind you before a key expires. A key unused for 90 days goes dormant: reactivate it in the panel.
Rotation
Rotating creates a new key with the same settings. You can keep the old one working for 1 or 24 hours while you switch.
IP allowlist
You can limit a key to addresses you list. Requests from other addresses return 401 ip_not_allowed.
Daily credit cap
A key that runs tools stops at its daily credit cap. Set it low for automated jobs.
Good practice
- Give each job its own key and only the scopes it needs.
- Keep keys on your server, in environment variables.
- Use an IP allowlist for fixed servers.
- Revoke a key at once if it may have leaked. This takes effect immediately.
- Check last use and masked IP on the key page.