Mavera DocsAccount & billing
Checking your Mavera sessionLoading workspace audiences and API keys…
Checking…Use or share this pageSend the page itself, print it, or open its complete context in your AI workspace.
API keys & admin
Key management and roles.
Who can administer
| Credential | Scope |
|---|---|
x-admin-token: <ADMIN_API_TOKEN> | Platform super-admin. Can target any workspace via a workspaceId in the body/query. |
| An API key whose member role is OWNER or ADMIN | Administers that key's own workspace. |
The admin-token compare is timing-safe. Set ADMIN_API_TOKEN to a long random secret in your environment.
API keys
# Mint — the plaintext key is returned ONCE; store it now.
POST /api/v1/keys -H "x-admin-token: $MAVERA_ADMIN_TOKEN" -d '{ "name": "Acme pilot" }'
# → data: { id, prefix:"mav_xxxx", key:"mav_…(48 hex)", note:"shown once" }
# List (metadata only — never the secret)
GET /api/v1/keys -H "x-admin-token: $MAVERA_ADMIN_TOKEN"
# Revoke — stops working immediately (401 on next call)
DELETE /api/v1/keys?id=<keyId> -H "x-admin-token: $MAVERA_ADMIN_TOKEN"Treat keys like passwords. Only the SHA-256 hash is stored — if a key leaks, revoke it and mint a new one. There's no way to recover the plaintext after creation.
What a key carries
- A
workspaceId— every call runs scoped to that workspace's data + credits. lastUsedAt— updated on each authenticated call, so you can find stale keys.revokedAt— set on revoke; the auth layer rejects revoked keys.
Members & roles
Workspace RBAC: OWNER > ADMIN > MEMBER > VIEWER. Manage via /api/v1/members (see Members & invitations). OWNER/ADMIN can mint keys and change billing.