Keys and limits
Send your key
Section titled “Send your key”Send it in the Authorization header of every call:
Authorization: Bearer mh_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxA key is mh_live_ and 32 letters, digits, - and _. Mayotte Hub keeps only a fingerprint of it, never the key
itself.
What a key may do
Section titled “What a key may do”Each key has scopes, chosen when it is made:
| Scope | Lets the key |
|---|---|
ping |
call GET /v1/ping |
webhooks |
send events to POST /v1/webhooks (the key then comes with a signing secret) |
A call outside the key’s scopes gets 403 with code scope.
Allowed addresses
Section titled “Allowed addresses”A key can be limited to the IP addresses of your servers, single addresses or ranges such as 203.0.113.0/24. A
call from anywhere else gets 403 with code ip. Tell Mayotte Hub which addresses you call from.
End date and revoking
Section titled “End date and revoking”A key can end after 30, 90 or 365 days, or never. A key that has ended gets expired; a key Mayotte Hub has revoked
gets revoked. Both are final: ask for a new key.
Limits
Section titled “Limits”| Limit | Value | When it is passed |
|---|---|---|
| Calls with one key | 300 a minute | 429, code rate |
| Calls from one address | 120 a minute | 429, code rate |
| Size of a body | 1 MB | 413, code too_large |
A 429 comes with a retry-after header in seconds. Wait that long before you call again.
Keeping keys safe
Section titled “Keeping keys safe”- Keep keys and signing secrets in your server’s secret store, not in code or in a repository.
- Never put them in an app, a web page or a log.
- If one may have leaked, ask Mayotte Hub to revoke the key at once and make a new one.