Developers · v1

Authentication

Every /v1 request is authenticated with an API key. There is no OAuth flow and no session cookie - just a key on every request.

API keys

Mint a key in the dashboard under Settings → API access. Keys start with mh_live_ and you can have up to 3 live at once per account.

Sending the key

Send it as an Authorization: Bearer header. An X-Api-Key header works too, if that fits your tooling better.

curl https://api.mastheads.app/v1/editions \
  -H "Authorization: Bearer mh_live_your_key_here"

Key lifecycle

Keys are server-side secrets: never ship one in browser code or commit one to a public repo. Revoke a key in Settings at any time - revocation is immediate, no propagation delay.

A key works for as long as the account's subscription or trial is active. Once it ends, the API returns 403 on every request - your content stays downloadable from the dashboard either way.