Public API

Create an API key and choose its scopes

Create the key in the workspace it will act on, grant only the scopes that integration needs, and store it as a secret. A key is shown once — if it is lost, revoke it and issue another rather than hunting for the original.

Reviewed August 20, 2026

Steps

1. Create the key inside the workspace whose codes it will touch. Keys do not cross workspaces.
2. Grant the narrowest scopes that let the integration work — read-only if it only reads.
3. Copy the key into your secret store immediately.
4. Authenticate with a Bearer token or the X-Mosaqo-API-Key header, whichever suits your client.
5. Restrict by address where you can, and rotate on a schedule.

How to check it worked

Call an identity endpoint such as /me. It should answer with the workspace you expect, which also confirms the key is scoped where you think.

What usually goes wrong

• A key committed to a repository or pasted into a chat.
• One all-powerful key shared by every integration.
• A key created in the wrong workspace, which then returns 403 on everything.