On this page

Projects and API Keys

An account holds projects. A project holds keys, rooms, webhooks and usage.

Accounts and teams#

You sign up in the dashboard. That makes a developer account for your company and makes you its owner. You can invite teammates by email. Roles:

Role	Can do
`developer`	Keys, rooms, webhooks and usage of every project.
`admin`	Everything a developer can, plus create and rename projects, settings (embed origins, limits), brand, members and invites.
`owner`	Everything an admin can, plus change owners and delete a project (only when it has no rooms).

The last owner cannot leave or be demoted. Test keys work as soon as you sign up. Live keys and invites need a verified email address.

Projects#

A project is one product or environment, for example "Acme web app". Rooms, webhook endpoints, usage, recordings and the embed allow-list all belong to one project, and another project can never see them. Make a project for each product, and one more for staging if you want clean numbers.

Keys#

A key is a secret that lets your server call the REST API.

mk_test_ keys see and make test rooms only. They cost nothing and are for development.
mk_live_ keys work on live rooms and count towards your usage. A project needs live mode switched on for these.
The format is mk_test_ or mk_live_ plus 32 letters and digits.
The full secret is shown once, when you create it. Meet stores only a hash and the first 12 characters. If you lose it, make a new key and revoke the old one.
Send it as a header: Authorization: Bearer mk_test_xxxxxxxx.

bash

curl "https://meet.respiresoft.com/api/v1/whoami" -H "Authorization: Bearer $MEET_API_KEY"

json

{ "project": { "id": "6f1c2b7e-3a54-4d0e-9c1b-2f7a8e5d4c10", "name": "Acme web app", "slug": "acme-web" }, "mode": "test", "key_prefix": "mk_test_AbCd" }

Keeping keys safe#

Keep keys in your server's environment or secret store. Never in a web page, a mobile app, a public repository or a log.
Browsers and apps get meeting tokens, not keys. See Meeting tokens.
Use one key for each service, so you can revoke one without stopping the others.
A wrong or revoked key answers 401 with invalid_api_key or revoked_api_key. A live key on a project without live mode answers 403 livemode_not_allowed.

Test and live are separate worlds#

A test key cannot see a live room, and a live key cannot see a test room. A room made with a test key sends its events to test webhook endpoints only, and its usage shows as test usage. Move to live by changing the key in your server's environment.