# API keys

Every request (except the docs files) needs an API key in the `Authorization` header:

```http
Authorization: Bearer mm_live_Ab3x...
```

## Keys

- Create keys on the [API page](https://moleman.io/app/api) of the app. Give each integration its own key ("Clay", "Zapier", "CRM sync"), so you can see its usage and revoke it alone.
- A key is shown **once**, when you create it. We store only a hash of it, so we cannot show it again. Lost it? Create a new one and revoke the old one.
- Keys belong to your **account**, not to a person: everyone on your team sees the same keys and can revoke them. The list shows who created each key and when it was last used.
- **Revoke** works at once: the very next request with that key gets `401 revoked_api_key`.
- Never put a key in a web page, a mobile app or a public repository. Keep it on a server or in your tool's secret settings.

## Live and test keys

| | `mm_live_…` | `mm_test_…` |
| --- | --- | --- |
| Results | real | made up, realistic, always the same for the same input |
| Credits | charged for emails that work | never charged |
| Contacts mail servers, websites, data sources | yes | never |
| Webhooks | sent | sent (so you can test your endpoint) |
| Data | your account's lists | separate test data, deleted after 30 days |

Test and live data never mix: reading a live job with a test key returns `403 wrong_key_mode`. See [Test mode](/docs/test-mode) for the test values.

## Errors

| Status | Code | Meaning |
| --- | --- | --- |
| 401 | `missing_api_key` | No key in the request. |
| 401 | `invalid_api_key` | Not a key we know (typo, cut off, deleted account). |
| 401 | `revoked_api_key` | The key was revoked. |
| 403 | `wrong_key_mode` | Test key on live data, or the other way round. |

Too many requests with wrong keys from one network (more than 30 a minute) get `429 rate_limited` for a minute.