Skip to main content

API keys

API keys are durable credentials for servers, bots, human-operated tools, and protocol integrations.

Use them from trusted backend environments only:

curl https://api.marking.fyi/v1/api-keys/introspect \
  -H "Authorization: Bearer $MARKING_API_KEY" \
  -X POST

Do not expose API keys in:

  • browser JavaScript;
  • query strings;
  • mobile app bundles;
  • public repositories;
  • logs.

Scopes​

Common scopes:

ScopeUse
readREST feed/status/history access
streamWebSocket streaming
attestationsoutcome-attestation access where enabled

For browser products, keep the Marking API key in your backend and relay only the data your application is authorized to show.