Keys

MIRA FIVE has three kinds of key. A website key sends events from browsers, a secret key sends events from servers, and an API key reads your analytics through the REST API and the MCP server.

Website and secret keys have the same shape. What makes a key one or the other is the source it belongs to, so keep track of which is which when you store them.

SourcesCopy Anchor Link

Events arrive through a source, and each source belongs to a project. A project usually has two:

• a Website source for the browser, with the list of domains allowed to send to it, and
• a Server source for your backend.

Each source has its own keys, its own status, and its own collection mode: Consentless or Full. The mode is a ceiling. A consentless source refuses batches sent in full mode.

Create a website keyCopy Anchor Link

1. In the dashboard, open the project and go to Data → Sources → Add source.
2. Choose Website. Enter a Name, the Allowed origins and the Collection mode.
3. Create the source. It comes with a first key named Default key, shown on the Install tab together with a ready snippet.

Put the key in your framework's public env var:

# Pick the one your framework reads
NEXT_PUBLIC_MIRAFIVE_KEY=mf_…
VITE_MIRAFIVE_KEY=mf_…
PUBLIC_MIRAFIVE_KEY=mf_…
NUXT_PUBLIC_MIRAFIVE_KEY=mf_…

A website key is public by design: every visitor can read it in the page. What protects it is the list of allowed origins. You can show and copy it again from the source's Ingest keys tab at any time.

Allowed originsCopy Anchor Link

Browsers may only send with a website key from an origin on its source's list.

• Enter exact origins: https://shop.example.com, or http://host:port. No paths, queries or wildcards.
• example.com and www.example.com count as one site.
• localhost and 127.0.0.1 on any port are always allowed, so you can test without adding them.
• Up to 50 origins per source.

A request from any other origin is refused with 403 origin_not_allowed.

Create a secret keyCopy Anchor Link

1. Go to Data → Sources → Add source and choose Server.
2. Name the source and create it.
3. Copy the key now. A secret key is shown once. MIRA FIVE stores only a hash of it.

Put it in your server's environment:

MIRAFIVE_SECRET_KEY=mf_…

Create an API keyCopy Anchor Link

1. Open the account menu and go to API & MCP.
2. Under API keys, choose New API key. Enter a Name (for example "Nightly report script") and pick when it Expires after: 30 days, 90 days, 1 year or never.
3. Choose Create key and copy it. It is shown once.

curl https://app.mirafive.io/api/v1/projects \
  -H "Authorization: Bearer $MIRAFIVE_API_KEY"

An API key acts as you: it sees every project you can see, in every organization you belong to. The REST API is read-only whatever the key allows. For the MCP server, each key has two switches, May change setup and May turn flags on and off. Both are off by default, and the key can then only read. See MCP server.

You can hold up to 20 API keys. Agents that support OAuth, like Claude and Cursor, do not need an API key. They sign in through the browser instead. See MCP server.

Environment variablesCopy Anchor Link

Every SDK reads the same names:

The API key has no standard name; the examples here use MIRAFIVE_API_KEY.

Rotate or revoke a keyCopy Anchor Link

• Website or secret key: on the source's Ingest keys tab, choose Issue key, deploy the new key, then revoke the old one. A revoked key is refused with 401 unauthorized at once.
• API key: create a new key on API & MCP, switch your scripts over, then Revoke the old one.
• OAuth apps (connected agents): Disconnect the app on API & MCP. That revokes all its tokens.

Only an organization owner or admin can issue and revoke source keys.

Key refusalsCopy Anchor Link

Every refusal is recorded on the key, and the source page shows the most recent one.