Authentication

Every request carries a key as a bearer token:

Authorization: Bearer mlm_live_Ab3xQ2p7vL9mN4rT8wY1zC5hK0jF3gD6sB2xV9nM4kP7qR1tW8yZ5c9f2k

The key names your organization. Nothing in the path does, and nothing in the request could: a key issued for one workspace cannot read or write another's catalogue, whatever it asks for.

The shape of a key

mlm_live_ + 43 characters

mlm_ is Maalam's; live or test says which environment minted it. A test key is one made against a staging or local Maalam, and a production API refuses it before it looks anything up — so a key pasted into the wrong config fails by its name rather than by a mystery 401. The distinctive prefix is also what secret scanners match when a key lands in a public repository.

Making and revoking keys

Keys are made by the owner of your workspace under Settings → API. Admins can see the list — name, prefix, last four characters, when each was last used — but not the key itself, which Maalam does not have: only a hash is stored.

A workspace may hold ten live keys. Revoking one takes effect within fifteen seconds everywhere; anything still sending it gets:

{ "error": { "code": "unauthorized", "message": "This API key was revoked" } }

Responses to a bad key

Keep it server-side

A key can write your catalogue. It belongs in your server's configuration, never in a browser, a mobile app, or a repository. If you need a website to read units, read them from your own system — that is what it is the source of truth for.