API

Authentication

Choose the right credential for each surface: browser SDK keys, management tokens, publisher tokens, or a user JWT session.

Rule of thumb

Browser site → pk_ / dk_ (API key). Server automation for a website → mt_ (mt_). Publisher automation → pt_ (Publisher). Logged-in apps → JWT (JWT).

Credential types

Name	Type	Description
`X-Api-Key`	`pk_ / dk_ / sk_`	Website context for Content API and SDK. Origin allowlist on frontend keys.
`X-Macro-Token`	`mt_`	Website Management API. Granular permissions; default deny.
`X-Macro-Publisher-Token`	`pt_`	Publisher v1 automation for listings and profile.
`Authorization: Bearer`	`JWT`	User session for Dashboard, Store /me, Publisher portal.

When to use which

X-Api-Key (pk_ / dk_ / legacy sk_)

Identifies the website for Content API and the browser SDK. Public / development keys are origin-restricted. Prefer Management mt_ tokens for new server automation; legacy sk_ secret keys still work on /content/* for prerender/CI. Create keys in Dashboard → SDK keys.

bash

curl -sS https://api.macrocontent.dev/content/values \
  -H "X-Api-Key: pk_..."

mt_ Management tokens (X-Macro-Token)

Per-website server tokens for /management/*. Default deny until you grant a preset or granular resource:action permissions. Preferred header: X-Macro-Token (Bearer also accepted). Guide: API tokens.

bash

curl -sS https://api.macrocontent.dev/management/whoami \
  -H "X-Macro-Token: mt_..."

Publisher tokens (pt_)

Scope: one publisher account — listings and profile only. Header X-Macro-Publisher-Token (or Bearer) on /publisher/v1. Not interchangeable with website mt_ tokens.

bash

curl -sS https://api.macrocontent.dev/publisher/v1/whoami \
  -H "X-Macro-Publisher-Token: pt_..."

JWT Bearer (apps & Store session)

Issued by central login / auth for Dashboard, Store /store/me/*, and Publisher portal session routes. Use for human-driven apps, not for long-lived CI. Editor overlay sessions are separate website-editor sessions (site users), not Management tokens.

Swagger Authorize

In Swagger UI, pick the scheme that matches the endpoint, paste the token, then Try it out. Full route catalogs stay in the OpenAPI specs linked from each API page.

Put only pk_ / dk_ in browser macro.config.js.
Store mt_ / pt_ in a secret manager or CI variables.
Use the smallest preset that works for each job.

Don’t

Don’t put mt_, pt_, or sk_ in frontend config.
Don’t reuse a publisher token on Management routes (or the reverse).
Don’t grant *:* / full admin to shared CI unless required.

Also see

Management API

mt_ route catalog and whoami.

Keys & config

Developer view of PUBLIC / DEVELOPMENT / SECRET keys.