Docs
Swagger

Dashboard

API tokens

Server automation with mt_ tokens on the Management API — default deny, presets, rotate, and deactivate.

mt_server

Default deny
New tokens start with zero permissions. Nothing works until you grant a preset or explicit resource:action rules. That is intentional — least privilege by default.

Where in the app

Website → Settings → API Tokens. Create a named token, pick a preset (or custom permissions), optionally restrict by IP, then copy the raw mt_… value — it is shown only once.

Authenticate

Preferred header:

bash
curl -sS https://api.macrocontent.dev/management/whoami \
  -H "X-Macro-Token: mt_..."

Bearer is also accepted:

bash
curl -sS https://api.macrocontent.dev/management/whoami \
  -H "Authorization: Bearer mt_..."

Management API base

GET/management/whoamimt_

Any valid token — returns identity and platformWebsiteId.

Base URL: https://api.macrocontent.dev/management. Full route catalog: Management API · interactive Swagger.

Permission presets

NameTypeDescription
read_only*:readRead everything the token surface exposes; no writes.
content_automationcontent.*Content read/write plus publish (nodes, values, versions).
data_automationdata.*Variables and data sources read/write, sync execute, activity read.
team_managerteam.*Manage team collaborators and site users (editors).
full_admin*:*Full Management API access for this website. Use sparingly.
Granular rules
Beyond presets you can grant wildcards such as content.*:read, *:read, or *:*. Deny rules can further restrict a grant. The dashboard permission catalog mirrors what the Management API exposes.

Create and use a token

  1. Create in Settings → API Tokens

    Name the token for its job (for example “CI content sync”). Apply a preset or custom allows.

  2. Store the raw token securely

    Copy mt_… into a secret store or CI variable. The dashboard only shows the full value at create/rotate time; afterward you see a masked prefix.

  3. Call the Management API

    Send X-Macro-Token on every request. Start with GET /management/whoami to verify the token and website binding.

Rotate, deactivate, delete

  • Rotate — issues a new raw token with a grace period for the previous value so you can update CI without an outage.
  • Deactivate / reactivate — disable a token without deleting history; reactivate when the job should run again.
  • Delete — permanent removal (owner only). Prefer deactivate unless you are sure.

Do

  • One token per automation job with the smallest preset that works.
  • Rotate after a leak or when an engineer leaves the project.
  • Use Activity filtered by token to audit usage.

Don’t

  • Don’t paste mt_ tokens into browser SDK config or public repos.
  • Don’t grant full_admin (*:*) to shared CI unless you truly need it.
  • Don’t confuse SDK keys (pk_ / dk_) with Management tokens.

Also see

Management API

OpenAPI for /management routes and permission requirements.

SDK keys

Browser PUBLIC / DEVELOPMENT keys for the site SDK.