Authenticate to the MisarDev API with a product-bound API key — full access, scoped to your MisarDev plan.

Overview

Every request to the MisarDev API, MCP server, and SDKs is authenticated with an API key. MisarDev keys:

are product-bound — a MisarDev key works only with MisarDev (api.misar.io/dev/*). It cannot be used with any other Misar product (Mail, Reach, Post, Blog, SEO, …), and their keys cannot be used with MisarDev.
grant full access — a key can call every public MisarDev endpoint (read, write, update, delete). Keys are not feature-scoped; you never have to pick permissions.
are plan-gated — the number of active keys you can hold is set by your active MisarDev subscription.

API keys act on your own MisarDev account. To act on behalf of other users, you need a workspace/service integration — contact us.

Creating a key

Sign in at misar.dev and open the MisarDev dashboard.
Go to Settings → API Keys.
Click Create key, give it a name (e.g. Production), and copy the secret.

The raw key is shown once at creation — store it somewhere safe. If you lose it, revoke the key and create a new one.

MisarDev keys always begin with the mdk_ prefix, so they are easy to recognize in logs and secret scanners:

mdk_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b

Key limits by plan

The per-plan key counts below are indicative — check Settings → API Keys for the exact allowance on your current MisarDev plan.

MisarDev plan	Active API keys
Free	1
Pro	10
Enterprise	100

If you hit the limit, revoke an unused key or upgrade your plan.

Using a key

Send the key in the Authorization header as a Bearer token:

curl https://api.misar.io/dev/v1/projects \
  -H "Authorization: Bearer mdk_YOUR_KEY_HERE"

The Api-Key mdk_… header scheme is also accepted, but Bearer is recommended. The same key works with the MisarDev SDKs and the MCP server.

Because a MisarDev key grants full access, treat it like a password. Never embed it in client-side code, browsers, or mobile apps — call the MisarDev API only from your server.

Product binding

MisarDev validates every key against its own database. A key issued by another Misar product is not present there, so it is rejected — and vice-versa. This means:

A MisarDev mdk_ key returns 401 Unauthorized on api.misar.io/mail/*, …/reach/*, …/post/*, etc.
A MisarMail msk_ key (or any other product's key) returns 401 Unauthorized on api.misar.io/dev/*.

There is no way to "share" one key across products — issue a separate key from each product's dashboard for each product you integrate with.

Revoking a key

Revoke a key from Settings → API Keys (or DELETE /api/api-keys with a { "keyId": "…" } body and a dashboard session). Revocation is immediate: the next request using that key returns 401.

Errors

Status	Meaning
`401 Unauthorized`	Missing, malformed, revoked, expired, or wrong-product key.
`403 Forbidden`	Key valid, but your MisarDev plan does not permit the action (or key limit reached at creation).
`429 Too Many Requests`	Rate limit exceeded — back off and retry after the `Retry-After` header.

See the API Overview for base URL, versioning, and rate limits.

Authentication