Skip to main content

​
Overview

Admins can create, view, and revoke API keys directly from the Moonbounce dashboard. API keys provide programmatic access to the Moonbounce API for your integrations and automated workflows. To manage API keys, navigate to Account Settings → API Keys.
Only users with the Admin role can access and manage API keys.

​
Creating an API Key

  1. Go to Account Settings → API Keys and click Create API Key.
  2. Enter a descriptive name for the key (e.g. “Production API Key”).
  3. Choose an expiration for how long the key should remain valid:
    • 30 days
    • 90 days
    • 180 days
    • 365 days
    • No expiration
  4. Click Create.
  5. Copy your API key immediately. The full key is only shown once and cannot be retrieved later.

​
Using Your API Key

Include your API key in the request headers when calling the Moonbounce API:
For SDK usage, refer to the Python SDK, JavaScript/TypeScript SDK, or Go SDK documentation.

​
Managing Existing Keys

The API Keys page displays all keys for your account, including: API keys start with mbsk_, followed by a key ID that identifies the key. The page shows that prefix and the key’s last 4 characters, which is enough to tell your keys apart but never enough to use one.

​
Legacy API keys

Keys in the older format show only their last 6 characters. Their last use isn’t tracked, so Last used shows a dash. Once your account creates mbsk_ keys, older keys are marked Legacy format. Legacy API keys still work; we recommend replacing them with new keys.

​
Key Actions

From the actions menu on each key, you can:
  • Disable — Temporarily deactivate a key. It can be re-enabled later.
  • Enable — Reactivate a previously disabled key.
  • Create replacement — Available on keys marked Legacy format. Creates a new key to take its place (see below).
  • Revoke — Permanently invalidate a key. This action cannot be undone.

​
Replacing a Legacy API Key

  1. From the legacy API key’s actions menu, click Create replacement.
  2. The create dialog opens with the old key’s name followed by “(replacement)”. The expiration is preset to the available option closest to the old key’s original lifetime (a key that never expired gets No expiration), counted from when you create the replacement. Adjust either if you like, then click Create.
  3. Copy the new API key immediately. As with any new key, it is only shown once.
  4. When you click Done, you’re offered to revoke the legacy API key. Revoke it only once your integrations use the new key: requests that still use the old key will fail. You can also click Cancel and revoke it later from its actions menu.

​
Best Practices

  • Rotate keys regularly. Create a new key before revoking an old one to avoid downtime.
  • Use descriptive names. Name keys after their intended use (e.g. “CI Pipeline”, “Staging Environment”) so you can easily identify them later.
  • Revoke unused keys. If a key is no longer needed, revoke it promptly to reduce your attack surface.
  • Never share keys in plaintext. Store API keys in environment variables or a secrets manager, not in source code.