API authentication

All server-to-server requests to the public API use the X-API-Key header.

X-API-Key: mfk_live_<workspace-key>

Store the value in a server-side secret manager or environment. Never put it in a browser, mobile app, repository, log, or user-facing example.

Idempotency

For send operations, use a unique Idempotency-Key so safe retries do not create duplicate sends.

Scopes

Grant an integration only the scopes it needs. The templates:read scope is used to read public templates and create previews.