MPH WMSAPI keys
Personal access keys for the REST API
API keys authenticate external systems against the MPH WMS REST API.
Requires settings:tenant. Find them under Settings → API keys.
Creating a key
Create a key, name it for the system that will use it, and copy it.
The key is shown once. Store it in the consuming system's secret store immediately. MPH keeps only a hash, so a lost key must be replaced rather than recovered.
Scope
A key is scoped to one organization and carries permissions, exactly like a user. Give an integration only what it needs - a stock-reporting script wants items:read and stock:read, and nothing else. If that key leaks, what it can do is what it was given.
Using a key
Send it as a bearer token:
curl https://your-instance/api/v1/items \
-H "Authorization: Bearer YOUR_API_KEY"See the API reference for the available resources, pagination and error format.
Feature gate
API access is gated by the has_api_access feature on your plan. If calls come back refused rather than unauthorised, check the plan before debugging the key.
Rotating and revoking
Revoke a key the moment someone who had it leaves, or if it may have been exposed. Revocation is immediate. To rotate without downtime, create the new key, deploy it, then revoke the old one.