API Authentication Guide
This guide provides comprehensive information on authentication methods for MOOD MNKY API services, including obtaining API keys, implementing authentication, and security best practices.Authentication Overview
MOOD MNKY API services use API key-based authentication to secure access to resources. All API requests must include a valid API key to authenticate the request. Different services in our ecosystem may have specific authentication requirements, but the core principles remain consistent across all services.API Key Types
We offer two types of API keys:| Key Type | Purpose | Rate Limits | Environment |
|---|---|---|---|
| Development Keys | For local testing and development | Higher limits | Local development |
| Production Keys | For production applications | Standard limits | Production |
- Development keys:
DEV_API_ - Production keys:
PROD_API_
Obtaining API Keys
Developer Portal
The primary method to obtain API keys is through the MOOD MNKY Developer Portal:- Visit developer.moodmnky.com
- Sign in or create a developer account
- Navigate to “API Keys” section
- Click “Create New API Key”
- Select the type of key (Development or Production)
- Choose the services you need access to
- Set any additional access controls
- Generate the key
Key Security
When you first generate an API key, it will be displayed only once. Make sure to:- Store it securely
- Never commit it to version control
- Use environment variables or secure key management systems
- Restrict access to those who need it
Authentication Implementation
Standard API Key Authentication
Most MOOD MNKY services use a standard API key header format:TypeScript/JavaScript
Python
Service-Specific Authentication
Some services may have unique authentication requirements:Ollama API
Ollama uses standard API key authentication:Flowise API
Flowise requires the API key in a custom header:Langchain API
Langchain requires the API key in the standard authorization header:n8n API
n8n uses a customX-N8N-API-KEY header:
Permission Management
Role-Based Access Control
API keys are associated with specific permission roles that determine what actions they can perform:| Role | Description | Permissions |
|---|---|---|
| Reader | Read-only access | GET operations |
| Writer | Read and write access | GET, POST, PUT operations |
| Admin | Full access | All operations including DELETE |
| Custom | Tailored permissions | Configurable |
Managing Permissions
To modify permissions for an existing API key:- Log in to the Developer Portal
- Navigate to “API Keys”
- Select the key you want to modify
- Click “Edit Permissions”
- Update the role or specific permissions
- Save the changes
Security Best Practices
API Key Protection
-
Use Environment Variables: Store API keys in environment variables, not in code.
- Implement Key Rotation: Regularly rotate your API keys (recommended every 90 days).
- Restrict Key Scope: Request only the permissions your application needs.
- Use HTTPS: Always make API requests over HTTPS.
- Implement IP Restrictions: Restrict API access to specific IP addresses when possible.
Key Rotation Implementation
Here’s how to implement key rotation with minimal downtime:Monitoring and Auditing
Usage Tracking
Monitor your API key usage through the Developer Portal:- Log in to the Developer Portal
- Navigate to “API Usage”
- View metrics by:
- Key
- Service
- Endpoint
- Time period
Audit Logging
Implement audit logging in your application:Troubleshooting
Common Authentication Errors
| Status Code | Error | Description | Solution |
|---|---|---|---|
| 401 | Unauthorized | Missing or invalid API key | Check your API key is correctly included in the request |
| 403 | Forbidden | Valid key but insufficient permissions | Request additional permissions or use a different key |
| 429 | Too Many Requests | Rate limit exceeded | Implement retries with exponential backoff |
Debugging Authentication Issues
If you’re experiencing authentication problems:- Check Key Validity: Ensure your key hasn’t expired or been revoked
- Verify Headers: Confirm the correct header format is being used
- Check Permissions: Verify your key has permissions for the operation
- Monitor Rate Limits: Check if you’ve exceeded your rate limits
- Test in Playground: Use the API playground in our documentation to test authentication
Rate Limiting
API keys are subject to rate limits:| Key Type | Default Rate Limit |
|---|---|
| Development | 5,000 requests per day |
| Production | 50,000 requests per day |