Authentication
Use your Publisher API key on every server-side request.
API keys
Every call to the Publishers API (GET /api/v1/publishers, Apps API, POST /surveys) must include a valid API key tied to your mypinio publisher organization.
Create keys in the Publisher Portal under Settings → API keys. The secret is displayed once when you create the key — copy it into your secrets manager immediately.
All apps in your organization use the same key pool. Restrict access to the key on your infrastructure (environment variables, secret store, not source code).
Request headers
Send one of:
| Header | Value |
|---|---|
Authorization | Bearer YOUR_API_KEY |
X-API-Key | YOUR_API_KEY |
Where to use the key
| Do | Don’t |
|---|---|
| Call the API from your backend | Embed the key in mobile apps, SPAs, or browser JavaScript |
| Rotate keys if exposed | Commit keys to git or share in chat |
| Use separate keys for test and production if your account has both | Reuse production keys in public client code |
Error responses
Invalid or missing key — HTTP 401
{
"error": "Invalid or missing API key. Use Authorization: Bearer <key> or X-API-Key header."
}Check the header name, spelling, and that the key was not revoked.
Valid key, access denied — HTTP 403
{
"requestStatus": "false",
"message": "Your API key is not linked to a publisher organization. Contact mypinio support."
}Your portal account may not be linked to a publisher organization yet. Sign in to the Publisher Portal once and create the key from there; if it persists, contact support.