API Keys
Mint and manage mrk_ developer keys, understand scopes, and the full-access default for the MisarReach API.
Every call to the MisarReach developer API, MCP server, and SDKs is authenticated with an mrk_ API key. This page covers minting, managing, and scoping keys. For the authentication model in depth, see Authentication.
Base URL: https://api.misar.io/reach/api · Header: Authorization: Bearer mrk_…
Minting a key
Open the dashboard
Sign in at reach.misar.io and go to Settings → API Keys (reach.misar.io/settings/api-keys).
Create the key
Click Create key, name it (e.g. Production), and copy the secret. The raw key is shown once — store it in a secret manager.
Use it
Send it as a Bearer token on every request:
curl https://api.misar.io/reach/api/lead-finder/leads \
-H "Authorization: Bearer mrk_YOUR_KEY_HERE"MisarReach keys always start with mrk_, so they are easy to spot in logs and secret scanners:
mrk_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2bFull-access default
Keys are minted full-access — a new mrk_ key can call every MisarReach developer endpoint (read, write, update, delete). You never have to pick permissions to get started; the default is the wildcard scope *.
Because a key grants full access by default, treat it like a password. Never ship it in client-side code, browsers, or mobile apps — call the API only from your server.
Scopes
Each operation in the OpenAPI contract declares an x-required-scope — the least-privilege scope it needs. The full-access * default satisfies all of them; the per-operation scopes document the model a scoped key would follow.
| Scope | Grants |
|---|---|
leads:search | Run lead discovery searches (/lead-finder/search, /lead-finder/discover) |
leads:read | Read leads, jobs, lists, saved searches, scoring rules, exports, ads audience |
leads:write | Create/update lists, saved searches, scoring rules, feedback, segment/campaign pushes |
leads:enrich | Enrich a saved lead (spends credits) |
leads:verify | Verify email deliverability (spends credits) |
leads:score | Score leads |
deals:read / deals:write | Read / manage deals and the pipeline |
channels:read / channels:write | Read channel status / connect and configure channels |
campaigns:read / campaigns:write | Read / manage and enqueue campaigns |
contacts:read / contacts:write | Read / manage CRM contacts, segments, imports |
conversations:read | Read the unified inbox |
autopilot:read / autopilot:write | Read runs / start and control autopilot |
sales_agent:read / sales_agent:write | Read config & actions / update config and run processing |
settings:read / settings:write | Read / set account settings (sender address) |
workspaces:read / workspaces:write | Read / manage workspaces and members |
deals:read also governs the Pipeline endpoints, and leads:read governs the Ads LinkedIn-audience endpoint — scopes are grouped by resource family, not by URL prefix.
Product binding
MisarReach validates every key against its own key table only. An mrk_ key returns 401 on any other product's API (…/mail/*, …/dev/*, …/post/*), and another product's key returns 401 on …/reach/*. Issue a separate key from each product's dashboard.
Key limits by plan
| MisarReach plan | Active API keys |
|---|---|
| Free | 1 |
| Starter | 3 |
| Pro | 10 |
| Scale | 25 |
| Enterprise | 100 |
Revoking a key
Revoke from Settings → API Keys. Revocation is immediate — the next request using that key returns 401. Rotate by creating a new key, deploying it, then revoking the old one.
See Rate limits for throttling and Errors for the error model.