Per-site API keys

Create revocable scoped API credentials for server-to-server automations without exposing widget keys.

Create a key

Open Admin → API keys, choose a descriptive name, expiration and minimum required scopes. The plaintext secret is shown only once.

Authorization: Bearer mbio_sk_...

Keys are stored as SHA-256 hashes. Revoke credentials immediately when an integration is retired or compromised.

v6 phase 2 includes authenticated contact read/write and event ingestion endpoints under /api/v1/. Scopes are enforced on every request.