API Keys Overview

API Keys provide read-only access to Metabind resources in production. While the Metabind web application uses JWT authentication for full administrative access, API Keys enable client applications (iOS, Android, React, web) to securely access published content without requiring user authentication.

Key Principles

Project Scoping

Each API key is scoped to a specific project and cannot access resources across projects. This provides a simplified permission model for client applications.

Read-Only Access

API keys provide read-only access. Content and components are limited to published versions:

Draft content requires JWT authentication with appropriate user roles
Draft content types (/types?draft=true) and the draft package (/packages/draft) can be read with an API key
Keys can be revoked at any time
Designed specifically for production content delivery

Client Integration

API keys are designed for client-side applications:

Easily integrates with mobile and web applications
Used as header parameter (x-api-key) in API requests
No token refresh or expiration management required

Security

Cannot create or modify resources
Content and components limited to published versions
No access to administrative functions
Activity is logged and monitored

The API Key Object

string

Unique identifier

string

Descriptive name for the key (e.g., “iOS App Production”)

string

The actual API key value (only shown at creation time)

string

Status: active or revoked

string

Last time the key was used (ISO 8601 format)

string

ID of the user who created the key

string

Creation timestamp (ISO 8601 format)

string

Last update timestamp (ISO 8601 format)

Example Object

{
  "id": "afd8012b-d81e-41c6-92cd-eed0c6cb3676",
  "name": "iOS Production App",
  "key": "7zvFJw9L0qEoYdKx2mBt1sLpZj3nX7gW",
  "status": "active",
  "createdAt": "2024-03-20T10:00:00Z",
  "updatedAt": "2024-03-20T10:00:00Z",
  "lastUsed": "2024-03-21T15:30:00Z",
  "createdBy": "user456"
}

The API key value is only returned once during creation. Store it securely as it cannot be retrieved later.

Client API Endpoints

For the complete list of endpoints accessible via API keys, see the Client API Endpoints section in the Authentication documentation.

Using API Keys

Include the API key in the x-api-key header:

curl -X GET "https://api.metabind.ai/api/v1/organizations/org123/projects/proj123/content" \
  -H "x-api-key: 7zvFJw9L0qEoYdKx2mBt1sLpZj3nX7gW"

For detailed integration examples including iOS, Android, and React implementations, see Using API Keys.

Getting Started

API Basics

Organizations

Projects

Saved Searches

Folders

Components

Component Assets

Collections

Packages

Draft Packages

Content Types

Content

Assets

Asset Searching

Tags

Roles

API Keys

API Keys Overview

Key Principles

Project Scoping

Read-Only Access

Client Integration

Security

The API Key Object

Example Object

Client API Endpoints

Using API Keys

​Key Principles

​Project Scoping

​Read-Only Access

​Client Integration

​Security

​The API Key Object

​Example Object

​Client API Endpoints

​Using API Keys

Key Principles

Project Scoping

Read-Only Access

Client Integration

Security

The API Key Object

Example Object

Client API Endpoints

Using API Keys