API keys

API keys authenticate requests to the public REST API. Manage them under Settings → API keys (requires edit company settings).

Create a key

1. Name it and, if useful, say what it is for.
2. Pick live (production data) or test. A test key (mca_test_…) is answered by your sandbox tenant when one is provisioned; until then it can only read production.
3. Choose scopes: per resource, read or read + write (deals, merchants, leads, payments, submissions, ISOs, funders, syndicators, payouts, renewals, credit facilities, compliance, applications, communications, statement analysis, webhook endpoints). Write implies read. A key with only the scopes it needs is the one you want.
4. Optionally set an expiry (30 / 90 / 365 days) and an IP allow-list (IPs or v4 CIDRs); requests from other addresses get 403.
5. Copy the token once; only a hash is stored.

Use a key

Send it as a bearer token against your company host, and start with whoami:

curl -H "Authorization: Bearer mca_live_…" https://acme.mcamgr.com/api/v1/whoami

whoami returns the key's name, kind, scopes, expiry, the tenant it is pointed at and the rate limit — the first thing to check when an integration misbehaves. Every response carries X-Request-Id (quote it when reporting a problem) and X-RateLimit-Limit / X-RateLimit-Remaining.

Rotate, revoke, usage

Rotate issues a replacement with the same name, scopes, expiry and allow-list and keeps the old key alive for 24 hours so you can switch without downtime. Revoke stops a key immediately. The list shows each key's call count, last use and the address it was last used from.

Keys created before scopes existed still work; their old flags are read as the matching scopes until you edit them.

Can’t find what you need? Return to the app or contact your administrator.