Overview
An API key lets your own systems, and integration tools such as Power Automate, call the Mobaro Public API on behalf of your organization. You create keys in the Backend, choose whether each one is read-only, and delete keys you no longer need.
This article covers creating, editing and deleting keys. To use a key in requests, see Getting started with the Mobaro API.
At a glance |
|
Who can do this | Super Users, or a Role with Organization › Administrate |
Where | Configuration › API › API Keys |
Works on | Backend (web). Keys are used with the Public API. |
Availability | Enabled per organization by Mobaro — ask your CSM |
⚠️ Heads-up: An API key acts with Super User access to your organization: it can read all of your organization's data, whoever created it, and a key that isn't Read-only can also change data. Treat every key like a password.
Check you have the API tab
The API tab appears in Configuration only when Mobaro has enabled Public API access (or webhooks) for your organization. If there's no API tab, or it only shows webhooks, ask your CSM.
Mobaro can enable full access or read-only access. With read-only access, new keys are read-only and the Read-only box can't be changed.
Create an API key
1. Open the API tab
In the Backend, go to Configuration › API. The API Keys panel lists your organization's keys.
2. Configure the key
Click the + button (tooltip Create). In Configure API key, enter a Name that says which integration uses the key. Read-only is ticked by default; read-only keys can't create, update or delete data. Untick it only if the integration needs to write. Click Save.
3. Copy the key
The API key created dialog shows the full key. Copy it into a secure store, such as a password or secrets manager, before you click Understood. Your integration sends it in the x-api-key header of every request.
⚠️ Heads-up: The full key is shown only once and can't be recovered, not even by Mobaro Support. If it's lost, create a new key and update every integration that used the old one.
Manage existing keys
The API Keys panel shows each key's Name, Prefix (the start of the key, to match a key to an integration), Created date and Read-only setting. The book icon (tooltip Open Documentation) opens the Mobaro API documentation.
Edit a key: select it and click the pencil (tooltip Update). Change the Name or Read-only and click Save. The key itself doesn't change, so integrations keep working.
Delete a key: select it and click the trash icon (tooltip Delete), then confirm.
Replace a key: create a new key, update the integration to use it, then delete the old key.
🛑 Critical: Deleting an API key can't be undone, and every integration that uses it stops working straight away. Check the key's name and prefix before you confirm.
Best practices
Create one key per integration and name it after that integration.
Keep keys Read-only unless the integration must create, update or delete data.
Store keys in a secrets manager. Never put them in browser code, email or chat.
Replace a key when someone who knew it leaves, and delete it straight away if it's exposed.
Delete keys you no longer use.
Frequently asked questions
Where do I find my API key?
In Configuration › API › API Keys. The panel lists each key's name and prefix, but the full key is shown only once, when it's created. If nobody saved it, create a new key, update your integration, and delete the old one.
Which permission do I need to create API keys?
Organization › Administrate, or Super User status. That permission opens Configuration, where the API tab is. Give it only to people who may manage your organization's settings. See Role permissions reference.
I can't see the API tab in Configuration. How do I get it?
Mobaro enables Public API access per organization, so ask your CSM. If the tab only shows webhooks, API access isn't enabled yet. See Getting started with the Mobaro API.
Can I restrict an API key to certain data or endpoints?
No. The only restriction is Read-only, which blocks creating, updating and deleting. Every key can read all of your organization's data. See Understanding API access scopes and limitations.
Can I see which API calls a key has made?
Not in the Backend. The API Keys panel shows each key's Name, Prefix, Created date and Read-only setting only. Give each integration its own key, so you can tell them apart and delete one without affecting the others.