minimusdocs
Help center

API keys: make, use and revoke

An API key lets a script act as your account. Make one per use, give it the smallest scopes, revoke it when it is no longer needed.

Make a key

  1. Open your API keys

    Sign in to the dashboard as the account the key should act for, then open API keys in the menu (also Profile → Manage API keys).

  2. Describe it

    Choose New key and fill in:

    • Name: what will use it — your shop, a billing system, an AI tool. You will see this name in the list and the call log.
    • What it can do: Read, Change, Delete and money. Tick only what the job needs.
    • Ends: Never, In 30 days, In 90 days, In a year or On a date. After that it stops working by itself.
    • Only from these addresses (optional): one address (203.0.113.4) or network (203.0.113.0/24) per line, up to 50. From anywhere else the key is refused.

    Confirm with Your account password (and a code from your authenticator app if two-step sign-in is on), then Make the key.

  3. Copy it now

    The key is shown once, right after you make it. Copy it into the place that will use it: an environment variable, your server's secret store, your AI tool's settings. The panel keeps only a fingerprint of it and can never show it again.

    A key looks like mk_live_ followed by 10 letters or digits, _, and 40 more. The first part (the prefix) is what the list shows, so you can tell your keys apart.

An account can have 25 working keys at once.

Use a key

Send it in the Authorization header of every request, after the word Bearer:

GET /auth/line-users/ HTTP/1.1
Host: panel.example.com
Authorization: Bearer mk_live_…

X-API-Key: mk_live_… works too, for tools that cannot set Authorization.

  • Always over https://: a key sent over plain http:// can be read on the way.
  • Keep it out of code you commit, screenshots and support messages. Read it from an environment variable, as in the examples on these pages.
  • One key per script, server or person: when one leaks or is retired, you revoke it alone.

See, narrow and revoke keys

API keys → Your keys lists your keys with their name, what they can do, when they end, when and from where they were last used, and their state. The key itself is never shown again.

  • Change this key: rename it, or take scopes away from it. A key can never be given more than it was made with: make a new key for that.
  • Calls: what the key did, newest first. See The call log.
  • Revoke: it stops working at once, everywhere; the next call made with it gets 401. Revoking cannot be undone, except by restoring a backup made before you revoked it. A revoked key stays in the list for a while, marked revoked.

The panel's owner, and staff given the permission Can see and revoke every account's API keys, also see All keys: every account's keys, to revoke one that should not be there. A reseller sees the keys of their sub-resellers there too.

Keys and AI apps

API keys are also how AI tools that run on your own computer can connect: Claude Code, Codex, Gemini CLI, Cursor, VS Code. Apps that run on the web (ChatGPT, Claude) connect by signing in instead, with no key to copy. See Minimus tools for AI apps.