Appearance
API keys
Every request carries an API key. Only administrators create keys, under Settings > API Keys.
Create a key
Click New API Key and fill in:
| Field | |
|---|---|
| Name | What uses it, e.g. WHMCS. Changes made with the key show under this name. |
| Acts as | An administrator: the key reaches every record (you, the operator). Or one reseller: it reaches only that reseller's subscribers, devices and credit, and only what the reseller's user group may do in the panel. Cannot be changed later. |
| Access | Read: only GET requests. Read and write: also add, change and delete. |
| IP addresses and ranges | Optional: only requests from these addresses (203.0.113.10) or ranges (10.0.0.0/8). Empty for any. |
| Expires | In 30, 90 or 365 days, or never. |
After Save, Mintrix shows the key once. Copy it into your system then: Mintrix keeps only a fingerprint of it and cannot show it again. If it is lost, revoke it and create a new one.
Keep keys secret
A key with write access can add devices and spend credit. Store it like a password, give each system its own key, and limit it to the addresses that system calls from.
Use a key
Send it in the Authorization header of every request:
sh
curl https://panel.example.com/api/rest/v1/devices \
-H "Authorization: Bearer mtx_your_key"Keys start with mtx_, so a leaked one is easy to recognise in logs or code.
Which key for what
| System | Acts as | Access |
|---|---|---|
| Your billing, selling to your own customers | An administrator | Read and write |
| A reseller's portal or billing | That reseller | Read and write |
| A report or monitoring script | An administrator, or a reseller | Read |
A reseller's key sees the reseller's own subscribers and devices and those of its sub-resellers. Devices it adds are paid from that reseller's credit.
The key list
The list under Settings > API Keys shows each key's start (mtx_Ab12Cd34…), who it acts as, its access and addresses, when and from which address it was last used, and when it expires.
- Edit changes the name, access and addresses.
- Revoke deletes the key. Requests with it are refused at once.
A key also stops working at once when the account it acts as is switched off.
In the history
Changes made through the API show in each record's History (in the row's actions in the panel's tables) as the key's account, with via API key and the key's name below it.