Authentication

Authentication

API Key

• All Muapi AI APIs require authentication using an API key. You must include your API key in the request headers for all API calls:

Obtaining an API Key

• To obtain an API key:

• 1. Go to the Muapi AI Dashboard
• 2. Sign in to your account or create a new account
• 3. Navigate to the API Keys section
• 4. Generate a new API key
• 5. Copy and securely store your API key

Sandbox vs. Production Keys

When generating a key, you can choose to create a Sandbox (Testing) key:

• Production Keys: Regular keys that consume credits and process real tasks.
• Sandbox Keys: Special keys marked with a Sandbox badge in your dashboard. These are used for free integration testing and return mock data instantly.

[!TIP] Always use a Sandbox key during development to avoid accidental credit consumption.

OAuth 2.0 (Agents & Machine Clients)

For agents and other machine clients, Muapi also supports OAuth 2.0's client_credentials grant — a scoped, short-lived alternative to a plain API key. Use this when you want to hand a credential to a third party or an autonomous agent without giving it full, unscoped access to your account.

1. Create an OAuth client: POST https://api.muapi.ai/oauth/clients (session-authenticated — call this from your own logged-in browser session, not with an API key), with a name and the scopes you want to grant. You'll get back a client_id and client_secret — the secret is shown once, store it like an API key.
2. Exchange it for an access token: POST https://api.muapi.ai/oauth/token with grant_type=client_credentials, client_id, client_secret, and an optional scope (space-separated; defaults to everything the client is allowed).
3. Use the returned access_token exactly like an API key: Authorization: Bearer <access_token>. Tokens expire after 1 hour — request a new one when it does.

Available scopes — see GET /oauth/scopes for the live, machine-readable list:

Scope	Grants
generate:write	Submit generation requests (image, video, audio, 3D, etc.) and consume credits.
generate:read	Poll prediction status and retrieve outputs.
files:write	Upload media to Muapi-hosted storage.
account:read	Read wallet balance, usage, and account/plan info.
keys:manage	Create, list, and revoke API keys and OAuth clients.

A client can only ever request scopes it was created with — request a narrower scope per token than the client's full allowed_scopes for extra least-privilege, e.g. hand a read-only agent a token scoped to generate:read account:read only.

Revoke a client with DELETE /oauth/clients/{id} — this invalidates any outstanding access token for it immediately, not just after the token's own 1-hour expiry.

Discovery metadata (for OAuth client libraries and agent scanners) is published at https://muapi.ai/.well-known/oauth-authorization-server (RFC 8414) and https://muapi.ai/.well-known/oauth-protected-resource (RFC 9728).

[!NOTE] This is machine-to-machine only — there's no user login/consent screen (authorization_code grant). If you're building something that needs a "Sign in with Muapi" flow for end users, that isn't supported yet.

Security Best Practices

• Never share your API key: Keep your API key confidential
• Don’t hardcode API keys: Use environment variables or secure key management systems
• Rotate keys periodically: Regularly generate new API keys and deprecate old ones
• Use restricted keys: When possible, create keys with limited permissions
• Keep safe: The API key will only be shown once. Please copy and store it securely. You won’t be able to retrieve it again.

Example Usage

1. cURL

curl --location --request POST 'https://muapi.ai/api/v1/endpoint' \
--header "Content-Type: application/json" \
--header "x-api-key: {MUAPIAPP_API_KEY}" \
--data-raw '{"param1": "value1", "param2": "value2"}

2. Python

import requests
import json

headers = {
  "x-api-key": f"{MUAPIAPP_API_KEY}",
  "Content-Type": "application/json"
}

payload = {
  "param1": "value1",
  "param2": "value2"
}

response = requests.post("https://api.muapi.ai/api/v1/endpoint",   json=payload, headers=headers)
print(response.json())

3. Javascript

const apiKey = process.env.MUAPIAPP_API_KEY;

const headers = {
  'x-api-key': `${apiKey}`,
  'Content-Type': 'application/json'
};

const payload = {
  param1: 'value1',
  param2: 'value2'
};

fetch('https://muapi.ai/api/v1/endpoint', {
  method: 'POST',
  headers: headers,
  body: JSON.stringify(payload)
})
.then(response => response.json())
.then(data => console.log(data))
.catch(error => console.error('Error:', error));