Skip to main content
Mobula supports two ways to authenticate: a static API key (from the dashboard) and short-lived API tokens (JWTs you create from that key). This guide explains the difference and shows examples for both.

​
Comparison

​
When to use an API key

Use your API key when:
  • You call the API from a backend you control (server, cron job, script).
  • You want one credential that does not expire (until you rotate it).
  • You need to create or revoke short-lived tokens (token management requires the API key).

​
Example: request with API key

You can send the key in the Authorization header or in x-api-key:

​
When to use an API token (short-lived)

Use a short-lived API token when:
  • You need to give a client (e.g. frontend, mobile app, partner service) access without sharing your main API key.
  • You want a credential that expires and optionally has a request limit.
  • You issue tokens from your backend and the client only holds the token.
Always use Bearer. Send the short-lived token only as Authorization: Bearer <token>. Do not send it in x-api-key.

​
Example: create a token, then call the API with it

Step 1 — Create a token (with your API key):
Response includes a token (JWT). Store it securely; it is returned only once. Step 2 — Call any endpoint with the token (Bearer only):

​
Summary

  • API key: Long-lived, from the dashboard. Use Authorization: YOUR_API_KEY or x-api-key: YOUR_API_KEY. Use it on the server and for creating tokens.
  • API token: Short-lived JWT from /api/2/auth/tokens. Use only Authorization: Bearer <token>. Use it for clients that should not see your API key.

Generate API key

Get your static API key from the dashboard

Auth Tokens API

Create, list, and revoke short-lived tokens