Authentication

All Mufi API requests are authenticated using Bearer tokens. Your API key acts as a JWT-signed token that identifies your project and permission level.

Getting Your API Key

Go to my.mufi.app and authenticate with your email via magic link.

Select or create a project

Each project has its own users, events, products, and API keys.

Generate an API key

Navigate to the API Keys section and generate a new key. You’ll receive a JWT token to use in your API requests.

Don’t have an account? Email connect@mufi.app to request access.

Using Your API Key

Include your API key as a Bearer token in the Authorization header of every request:

Authorization: Bearer YOUR_API_KEY

curl -H "Authorization: Bearer $MUFI_API_KEY" \
  https://api.mufi.app/v1/version

const response = await fetch('https://api.mufi.app/v1/version', {
  headers: { 'Authorization': `Bearer ${process.env.MUFI_API_KEY}` }
});

import os, requests

response = requests.get('https://api.mufi.app/v1/version', headers={
    'Authorization': f'Bearer {os.getenv("MUFI_API_KEY")}'
})

Permission Levels

Each API key has one of two permission levels:

Permission	What it allows
Write	Full access — create and modify users, events, products, and all resources
Read	Query-only — fetch users, list events, check balances, view products

Calling a write-only endpoint with a read-only key returns 403 Forbidden.

Key Management

Behavior	Detail
Expiration	API keys do not expire automatically — they remain valid until revoked
Regeneration	You can regenerate a key at any time from the Dashboard. The old key is immediately invalidated
Multiple keys	Generate separate keys for different environments (staging, production) or services

Security Checklist

Store API keys in environment variables, never in source code

Use keys only on the server side — never expose them in frontend code

Use read-only keys when you only need to query data

Regenerate keys immediately if you suspect they’ve been compromised

Use separate keys for staging and production environments

If your API key is compromised, regenerate it immediately from the Mufi Dashboard or email connect@mufi.app for emergency revocation.

Getting Started

Platform

Security & Infrastructure

API Playground

Authentication

Getting Your API Key

Using Your API Key

Permission Levels

Key Management

Security Checklist

​Getting Your API Key

​Using Your API Key

​Permission Levels

​Key Management

​Security Checklist

Getting Your API Key

Using Your API Key

Permission Levels

Key Management

Security Checklist