API Keys
Generate and revoke your MisarBlog API key.
Each MisarBlog creator has a single API key used for all programmatic access. Generating a new key replaces (rotates) any existing one.
These endpoints are authenticated with your dashboard session cookie and require a valid CSRF token — they are called from the signed-in dashboard, not with an API key. Key format: mbk_ followed by 64 hexadecimal characters (68 characters total). The stored prefix is mbk_ plus the first 6 hex characters and is used only for identification.
Generate (or Rotate) Your API Key
/blog/v1/keysGenerates a new API key and stores its hash on your profile. If you already have a key, this replaces it — the previous key stops working immediately.
The raw key is returned only once at creation. Store it securely; it cannot be retrieved again.
Rate limited to 5 generations per hour. Requires a valid session and CSRF token.
Response fields
keystringThe full API key (mbk_...). Shown only once — save it immediately.
prefixstringShort identifier (mbk_ + first 6 hex characters) used to recognize the key later.
messagestringReminder that the key will not be shown again.
{
"key": "mbk_SHOWN_ONCE_STORE_IMMEDIATELY",
"prefix": "mbk_a1b2c3",
"message": "Save this key — it will not be shown again."
}Revoke Your API Key
/blog/v1/keysImmediately invalidates your current API key. Any integration using it will start receiving 401 errors. Requires a valid session and CSRF token.
Response fields
revokedbooleantrue when the key was cleared from your profile.
{ "revoked": true }MCP Connect
If you're setting up the MisarBlog MCP server, use the MCP connect flow (POST /api/v1/auth/mcp-connect) instead — it generates an mbk_ key and delivers it to your local MCP client automatically.
Errors
| Status | Description |
|---|---|
401 | Not signed in (missing or invalid session) |
403 | Invalid CSRF token |
429 | Rate limit exceeded (5 key generations per hour) |
500 | Failed to save the API key |