Authentication

Send your API key with every request.

Create an API key

1. Open the API page of the dashboard. It's also in the account menu, under API.
2. Select New key, name it after the service that will use it, such as "CI" or "Docs sync", and select Create key.
3. Copy the key. It is shown once, so store it in your secrets manager right away.

Keys start with mnfst_api_. You can hold up to 10 keys. Give each service its own key, so you can revoke one without touching the others. The API page lists each key's prefix, name, creation date, and when it was last used.

Platform account keys are issued by Manifest when the account is set up.

Send the key

Send the key on every request as a bearer token, Authorization: Bearer <key>:

curl https://api.manifestx.dev/v1/me \
  -H "Authorization: Bearer $MANIFEST_ACCOUNT_KEY"

GET /me confirms the key works and returns the API account it belongs to:

{
  "account": {
    "id": "acct_…",
    "name": "Sam Rivera",
    "plan": "free",
    "max_projects": 2,
    "created_at": 1760140800
  },
  "rate_limit": { "requests_per_minute": 60 },
  "key": { "prefix": "mnfst_api_AbCd1234" },
  "request_id": "…"
}

plan is free for the free allowance that comes with every Manifest account, or platform for a platform account. max_projects is how many projects the key can create through the API. See Manage for what the key can do.

Keep the key on your server. It can act on every project it reaches, so never ship it to a browser or a site's repository.

No CORS: call the API from your server, never from a browser.

Project keys

Creating a project also returns that project's own key, project_key, once. It is a normal Manifest project key for publishing that one project headless, for example from its CI with mnfst-publish. The API doesn't need it: your API key already reaches the project. See Create a project.

Revoke a key

On the API page, select the trash icon next to the key, then Revoke key. The key stops working on the next request and can't be restored. If a key leaks, revoke it and create a new one. To revoke a platform account key, contact Manifest.

Errors

The message says which key problem it is: