Authentication

Overview

Every request to the MisarBlog API, MCP server, and SDKs is authenticated with an API key. MisarBlog keys:

• are product-bound — a MisarBlog key works only with MisarBlog (api.misar.io/blog/*). It cannot be used with any other Misar product (Mail, Reach, Dev, Post, …), and their keys cannot be used with MisarBlog.
• grant full access — a key can call every public MisarBlog endpoint (read, write, update, delete). Keys are not feature-scoped; you never have to pick permissions when creating one.
• are plan-gated — the number of active keys you can hold is set by your active MisarBlog subscription.

All MisarBlog API requests carry the key as a Bearer token in the Authorization header:

Authorization: Bearer mbk_YOUR_API_KEY

Getting an API Key

1. Sign in to your MisarBlog account at misar.blog
2. Go to Dashboard → Settings → API Keys
3. Click Create API Key, give it a name, and copy the key immediately — it's shown only once

Keys always start with the mbk_ prefix followed by 64 hexadecimal characters (68 characters total), so they are easy to recognize in logs and secret scanners. The raw key is shown once at creation — if you lose it, revoke the key and create a new one.

Using Your Key

curl https://api.misar.io/blog/v1/me \
  -H "Authorization: Bearer mbk_YOUR_KEY"

const res = await fetch("https://api.misar.io/blog/v1/me", {
  headers: { Authorization: `Bearer ${process.env.MISARBLOG_API_KEY}` },
});

Product binding

MisarBlog validates every key against its own database. A key issued by another Misar product is not present there, so it is rejected — and vice-versa. This means:

• A MisarBlog mbk_ key returns 401 Unauthorized on api.misar.io/mail/*, …/reach/*, …/post/*, etc.
• A MisarMail msk_ key (or any other product's key) returns 401 Unauthorized on api.misar.io/blog/*.

There is no way to "share" one key across products — issue a separate key from each product's dashboard for each product you integrate with.

MCP Authentication

If you're connecting the MisarBlog MCP server, use the MCP connect flow instead of creating a key manually:

POST /api/v1/auth/mcp-connect

This endpoint is session-authenticated (cookie). It generates a full-access mbk_ key, stores the hash in your profile, and delivers the raw key to your local MCP client via a localhost callback URL.

See the MCP Setup guide for the full flow.

Revoking Keys

Go to Dashboard → Settings → API Keys and click Revoke next to any key. Keys can also be revoked programmatically — see API Keys for details.

Security

• Store keys in environment variables — never commit them
• Each key is hashed before storage; the raw key is unrecoverable after creation
• Treat every key as full-access — use separate keys per integration for easy, independent rotation

Error Responses