Skip to main content
Every request to the API must be authenticated. There is no anonymous access beyond the health endpoints.

​
API keys

Organization API keys are the normal way to call Moneyline from a server. The prefix tells you — and the API — which environment the key belongs to.
The environment is derived from the key prefix, not from the URL or a header. A ml_test_ key sent to production reads and writes sandbox data.
Send the key one of two ways. Both are accepted on every endpoint:
All three SDKs read MONEYLINE_API_KEY from the environment, so the key rarely appears in code:
To pass one explicitly:

​
Personal access tokens

Tokens prefixed ml_pat_ authenticate as a user rather than an organization, and carry that user’s permissions. They are intended for CLI use and local scripting, not for server-to-server traffic.

​
Session cookies

The dashboard authenticates with a session cookie issued by Better-Auth. This path exists for the first-party dashboard only — it is not a supported integration surface, and it is not exercised by the SDKs.

​
Rotating a key

Create the replacement first, deploy it, then revoke the old key. Revocation takes effect immediately and in-flight requests using the revoked key will fail.
The plaintext key is returned once, at creation. Afterwards only its prefix and last four characters are readable.

​
Storing keys

Never commit an API key, and never send one to the browser. A ml_live_ key grants full read and write access to every submission in the organization.
Keep keys in your secret manager and expose them to the process as MONEYLINE_API_KEY. If a key leaks, revoke it — rotation is cheap, and there is no way to scope a leaked key retroactively.