API Keys & Scopes
Mint and manage mbk_ developer keys for the MisarBlog API, the scope model, rate limits, and OAuth 2.1 token support.
Every request to the MisarBlog developer API (https://api.misar.io/blog/v1) is authenticated with a Bearer credential. Two credential types are accepted on the same Authorization header:
- A MisarBlog developer key — the
mbk_prefix. - An OAuth 2.1 access token minted at
/api/oauth/token.
Keys are validated against the blog-owned key store, so an API key from any other Misar product (MisarMail msk_, MisarReach mrk_, …) is rejected here — and an mbk_ key only works against api.misar.io/blog/*.
Mint an mbk_ key
Developer keys are created from the signed-in dashboard, not with another key:
Open the API Keys page
Go to Dashboard → Settings → API Keys on your MisarBlog account.
Generate a key
Generating a key returns the full secret once. It has the shape mbk_ + 64 hexadecimal characters (68 chars total). Store it immediately — it cannot be retrieved again.
Use it as a Bearer token
curl https://api.misar.io/blog/v1/me \
-H "Authorization: Bearer mbk_YOUR_KEY"Each creator has a single active key; generating a new one rotates (replaces) the previous one, which stops working immediately. Key creation and revocation require a dashboard session and a CSRF token — see API Keys (rotate/revoke) for those endpoints.
Key prefix
Only a short prefix (mbk_ + the first 6 hex characters) is stored for identification. The full secret is hashed at rest and never shown again after creation.
Scope model
Keys today are minted full-access — a valid mbk_ key can call every operation your plan allows. The API additionally publishes, per operation, the least-privilege scope a future scoped key (the planned "System B") would need. This is surfaced as the x-required-scope extension on each operation in the OpenAPI spec.
The scope model is documented but dormant — scoped keys are not yet issued, and no request is currently rejected for a missing scope. Treat x-required-scope as forward-looking guidance so integrations request only what they need once scoped keys ship.
Prop
Type
Operations without an x-required-scope (profile, plan, trial, reactions, images, and AI title/completion) are available to any authenticated key.
Rate limits
Every /blog/v1/* request is limited to 100 requests per minute per key. Exceeding it returns 429 Too Many Requests:
{ "error": "Rate limit exceeded — 100 req/min" }Back off and retry when you see a 429. See Errors for the full status-code reference.
OAuth 2.1 tokens
The same endpoints accept OAuth 2.1 access tokens. Mint one via the authorization-code + PKCE flow at /api/oauth/token, then send it exactly like a key:
curl https://api.misar.io/blog/v1/me \
-H "Authorization: Bearer <oauth_access_token>"Use OAuth when a third-party app acts on a creator's behalf; use an mbk_ key for your own first-party integrations and scripts. See the OAuth reference for the full flow, endpoints, and token lifetimes.