Every key belongs to one project and one environment. Create and revoke them in Developers → API keys; creating and revoking needs the admin role and both are written to the audit log.
Kinds of keys
| Kind | Prefix | Where it lives | What it can do |
|---|---|---|---|
| Secret, production | mf_live_ | your server or build | read content (content:read), plus the scopes you add |
| Secret, development | mf_test_ | your machine, staging | content:read and content:preview by default |
| Publishable | mf_pk_live_, mf_pk_test_ | the page source | send analytics and form submissions from its domains |
The full secret is shown once, when you create it. Manifolio keeps only its prefix and a keyed hash, so a lost key cannot be recovered: revoke it and create a new one.
Scopes
| Scope | Allows |
|---|---|
content:read | the Delivery API |
content:preview | the Preview API, drafts included |
content:write | reserved for writing content through the API |
analytics:read | reserved for reading analytics through the API |
A request without the right scope gets 403 missing_scope.
Domains for publishable keys
A publishable key has a list of domains instead of scopes, for example aurora.coffee and *.aurora.coffee. Requests from anywhere else get 403 host_not_allowed. Development publishable keys also accept localhost and 127.0.0.1.
Revoking
Revoking takes effect at once: requests with the key get 401 key_revoked. A project can have up to 50 active keys.
Keeping keys safe
- Keep secret keys in server environment variables or your host's secret store, never in client code or in git.
- Use a development key locally and a production key only where the live site is built or served.
- The API logs tab shows every request with its key, path, status and time, so a key used where it should not be is easy to spot.