API keys

Create a key under Settings → API Keys. The full key is shown only once at creation — store it securely. Keys are prefixed with stk_live_.

Making a request

Pass the key in the Authorization header as a Bearer token:

curl https://api.metakit.cloud/v1/usage \
  -H "Authorization: Bearer stk_live_xxxxxxxxxxxxxxxxxxxx"

Scopes

Each key is created with a scope. A readonly key may only make GET requests; a full key may also write. Prefer readonly whenever an integration only reads data — especially when handing a key to an AI agent or third-party tool.

A write attempted with a read-only key returns 403 insufficient_scope. This is separate from an account's slot tier, which uses the same two words — both gates apply.

Expiry

Keys can be given an expiry date when created. Requests made with an expired key return 401 key_expired. A key created without an expiry stays valid until you revoke it.