API Authentication and Key Safety
Use scoped Manifest AI Bearer keys safely, rotate credentials, and isolate production integrations.
Manifest AI API v1 uses server-side Bearer keys. A key is revealed once, stored only as a cryptographic digest, and can be scoped, expired, rotated, or revoked from the developer workspace.
Authorization header
Send the key in every protected request.
HTTP
Authorization: Bearer mai_live_YOUR_SECRETLeast-privilege scopes
Grant only the operations each application needs.
- documents:read
- List documents and profiles, then read document status and retained results.
- documents:write
- Submit documents and perform pause, resume, cancel, or deletion actions.
- exports:read
- Download completed Excel workbooks.
Key operations
Use separate credentials for each environment and integration.
- Create production and test keys separately.
- Set an expiry where operationally practical.
- Rotate by creating the replacement before revoking the old key.
- Revoke immediately after suspected exposure.
- Never send a key through query parameters, analytics, logs, or client-side code.