Docs / Get started
Authentication
Every V1 call carries a project key in the Authorization header:
curl https://hub.masjidbox.com/v1/masjids/msj_ap20t2m2tk \
-H "Authorization: Bearer $MASJIDBOX_KEY"A call without a key, or with a key that is malformed, unknown or revoked, answers 401 with the code INVALID_API_KEY. There are no test keys: every key reads the live data.
Secret or publishable
| Key | Where it lives | If it leaks |
|---|---|---|
mbx_sk_live_… secret | Your server only | Revoke it at once |
mbx_pk_live_… publishable | A browser, a mobile app | Expected: it only reads, and it is rate-limited |
Use a secret key whenever the call can go through your own server. Use a publishable key when the call has to come from the visitor's device; anyone can read it from your page or your app, so treat it as public.
Projects and keys
A project is one app. Its keys share its quota, so a second key does not give you a second quota. Create one key per place that calls the API (a server, a website, an app), so you can revoke one without touching the others.
Keep a secret key secret
- Read it from an environment variable or a secret manager, never from your source code.
- We store only a hash of it: nobody, us included, can show it again. Lost it? Create a new one and revoke the old one.
- If it leaks, revoke it from the console. A revoked key is refused within a minute, everywhere.