Authenticate to the MisarReach API with a product-bound API key — full access, scoped to your MisarReach plan.

Overview

Every request to the MisarReach API, MCP server, and SDKs is authenticated with an API key. MisarReach keys:

are product-bound — a MisarReach key works only with MisarReach (api.misar.io/reach/*). It cannot be used with any other Misar product (Mail, Dev, Post, SEO, …), and their keys cannot be used with MisarReach.
grant full access — a key can call every public MisarReach endpoint (read, write, update, delete). Keys are not feature-scoped; you never have to pick permissions.
are plan-gated — the number of active keys you can hold is set by your active MisarReach subscription.

API keys act on your own MisarReach account. To act on behalf of other users, you need a workspace/service integration — contact us.

Creating a key

Sign in at misarreach.com and open the MisarReach dashboard.
Go to Settings → API Keys.
Click Create key, give it a name (e.g. Production), and copy the secret.

The raw key is shown once at creation — store it somewhere safe. If you lose it, revoke the key and create a new one.

MisarReach keys always begin with the mrk_ prefix, so they are easy to recognize in logs and secret scanners:

mrk_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b

Key limits by plan

MisarReach plan	Active API keys
Free	1
Starter	3
Pro	10
Scale	25
Enterprise	100

If you hit the limit, revoke an unused key or upgrade your plan.

Using a key

Send the key in the Authorization header as a Bearer token:

curl https://api.misar.io/reach/api/campaigns \
  -H "Authorization: Bearer mrk_YOUR_KEY_HERE"

The same key works with the MisarReach SDKs and the MCP server.

Because a MisarReach key grants full access, treat it like a password. Never embed it in client-side code, browsers, or mobile apps — call the MisarReach API only from your server.

Product binding

MisarReach validates every key against its own database. A key issued by another Misar product is not present there, so it is rejected — and vice-versa. This means:

A MisarReach mrk_ key returns 401 Unauthorized on api.misar.io/mail/*, …/dev/*, …/post/*, etc.
A MisarMail msk_ key (or any other product's key) returns 401 Unauthorized on api.misar.io/reach/*.

There is no way to "share" one key across products — issue a separate key from each product's dashboard for each product you integrate with.

Revoking a key

Revoke a key from Settings → API Keys (or DELETE /reach/api/api-keys/{id} with a dashboard session). Revocation is immediate: the next request using that key returns 401.

Errors

Status	Meaning
`401 Unauthorized`	Missing, malformed, revoked, or wrong-product key.
`403 Forbidden`	Key valid, but your MisarReach plan does not permit the action (or key limit reached at creation).
`429 Too Many Requests`	Rate limit exceeded — back off and retry after the `Retry-After` header.

See Errors for the full error model.

Authentication