API keys — IngevoraMirage

API keysAn API key lets your server fetch your workspace's published face lenses and screen effects from the delivery API. It is the only credential the delivery API accepts.Who can manage keysOwners and Developers. Designers don't see the API keys page; ask an Owner or a Developer for a key.Create a key

Open API keys under Workspace in the navigation.

Type a New key name that says where the key will live, such as "production server" or "staging server".

Choose Issue key.

The New API key dialog shows the key. Choose Copy, store the key somewhere safe, then choose I have stored it.

Keys start with mk_.

Important: The key is shown exactly once. IngevoraMirage keeps only a hash of it, so nobody can show it to you again. If you lose a key, revoke it and issue a new one.

Use a keySend the key in the X-Api-Key header of every delivery request:

http

GET /v1/lenses/8f3c2a10-… HTTP/1.1
Host: mirage-api.ingevora.com
X-Api-Key: mk_…

One key works for both products. Whether a product answers depends on your workspace, not on the key: if screen effects are off for your workspace, every key gets a 403 for them. A missing, unknown or revoked key gets a 401. See Delivery API.Keep it on your own serverTreat a key like a password. Anyone who has it can fetch your workspace's published items.

Keep the key on your own server, in an environment variable or a secret store. Your server calls the delivery API, resolves the ids and caches the answers. Your app asks your server.

Don't put a key in a web page, in an app you ship to phones, or in source control.

When the SDKs ship, a phone app will hold its key only through the SDK. Until then, keep keys out of apps.

One key per appIssue a separate key for each app and each server. Then a leak, or a server you retire, costs you one key while the others keep working. A clear name tells you which key is which.The key listThe list shows each key's name, its first characters (for example mk_AbCdEfGh…), the date it was created, and its status: Active or Revoked. The full key is never shown again.Revoke a keyRevoke a key as soon as you think it has leaked, or when you stop using it.

Choose Revoke on the key's row.

The dialog warns that requests using the key stop working immediately, and that this can't be undone. Choose Revoke key.

A revoked key can never be used again, and there is no undo.Replace a key

A key that leaked: revoke it first, then issue a new one and put it on your server. Requests fail in between, but nobody else can use the old key.

A key you are rotating: issue the new key, switch your server to it, check that requests work, then revoke the old key. Nothing fails in between.

Delivery API — the routes your key unlocks.

Errors and limits — what 401 and 403 mean and what to do.

Workspaces and roles — who can do what.