Authentication

Creating a key

Open API keys in the Studio and create a key. The full secret — mm_live_… — is shown once, at creation. Store it somewhere safe; afterward only the prefix is visible, and a lost key must be revoked and replaced.

Sending the key

Send the key on every request. Either header works — pick one:

A missing key returns 401 with a message telling you which headers are accepted; an invalid or revoked key also returns 401. See Errors & credits.

Keep keys server-side

Scopes and environments

The default generate scope covers App profile access, discovery and available generation routes. Keys belong to the API where you created them. Use a production key with the production API and a development key with the development API; the mm_live_ prefix alone does not identify either one.

Google Play publication requires a separate publish scope. In Studio, explicitly enable Allow publishing to connected stores when creating the key. Existing generate-only keys are not broadened automatically. To publish, create a key with that permission. A missing scope returns 403 API_SCOPE_REQUIRED with the required scopes. See Publishing & verification.

Your key can access only your account’s App profiles and generated files. Connect store accounts in Studio; you do not need to include store credentials in your API requests.

Rotating a key

Keys don't expire automatically. To replace a key, create a new one, update your application or assistant’s configuration, then revoke the old one from the API keys page. Revocation takes effect immediately — the next request with the old key gets 401.