Getting started

Authentication

Every request to the public API is authenticated with a secret key tied to your account. Keys carry your plan's monthly credit allowance.

Creating a key

Open API keys in the Studio and create a key. The full secret — mm_live_… — is shown once, at creation. Store it somewhere safe; afterward only the prefix is visible, and a lost key must be revoked and replaced.

Sending the key

Send the key on every request. Either header works — pick one:

Authorization header (recommended)

curl https://api.applistinglab.com/api/v1/public/v1/apps \
  -H "Authorization: Bearer mm_live_…"

x-api-key header

curl https://api.applistinglab.com/api/v1/public/v1/apps \
  -H "x-api-key: mm_live_…"

A missing key returns 401 with a message telling you which headers are accepted; an invalid or revoked key also returns 401. See Errors & credits.

Keep keys server-side

Never expose a key in a client

A mm_live_ key grants full access to your account's credits. Keep it on a server or in your CI secrets — never in browser JavaScript, a mobile binary, or a committed .env. If a key leaks, revoke it immediately and issue a new one.

Rotating a key

Keys don't expire on their own. To rotate: create a new key, deploy it, then revoke the old one from the API keys page. Revocation takes effect immediately — the next request with the old key gets 401.