Authentication & API keys

Every Developer API request is authenticated with an API key sent as a bearer token:

GET /api/v1/me HTTP/1.1
Host: manush.si
Authorization: Bearer mk_test_a1b2c3d4e5f6_Xy…

The X-API-Key: <key> header is also accepted.

Key format

Keys look like mk_{env}_{prefix}_{secret}:

• env — test for sandbox keys, live for live keys.
• prefix — 12 hex characters, shown in your dashboard so you can recognise a key.
• secret — 40 random characters.

MANUSH stores only the prefix in clear text and a SHA-256 hash of the full key. The full key is shown exactly once when you create or rotate it — store it in a secret manager, never in source control.

Scopes

Give each key the smallest set of scopes it needs. A request with a key that lacks the scope gets 403.

Apps

Group keys by integration with apps (e.g. "WMS connector", "CI pipeline"). Deleting an app can revoke all of its keys.

Rotation and revocation

• Rotate issues a new key with the same name, scopes, environment, rate limit and expiry, and revokes the old key immediately.
• Revoke disables a key permanently. Revoked and expired keys return 401.
• Keys can carry an expiry date; after it, requests fail with 401.
• If a developer account is suspended, all of its keys stop working.

Usage

Every authenticated request is metered per key, endpoint and day. Your dashboard shows the last 30 days by endpoint, and each key page shows its own usage table.