Authentication

The API authenticates requests with a bearer API key. Keep keys server-side — never ship them in client code.

Passing your key

Send your key as a bearer token on every request:

Authorization: Bearer mt_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Alternatively, the X-API-Key header is accepted:

X-API-Key: mt_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Key prefixes

Unauthorized requests

Requests with a missing or invalid key return 401 with a structured error:

{
  "error": {
    "code": "missing_api_key",
    "message": "Provide an API key via the `Authorization: Bearer <key>` header.",
    "status": 401
  }
}

Getting a live key

Live keys (mt_live_) are issued from the Settings page of your Material Transition account at app.materialtransition.com/account. Generate a key there and copy it — it is only shown once.

Mock preview behavior

While this preview is mock-backed, any key prefixed with mt_ (plus the demo key) is accepted so you can try the reference console immediately. Real validation against hashed keys and per-minute / per-day rate limits is enforced in production.