API keys

Use an API key to authorize your requests to the MASV API.

API keys simplify integration with the MASV API in these ways:

• The username and password do not need to be hardcoded or stored.
• The key does not require a refresh after expiration every few days.
• An API key, while active, does not require the user to periodically answer multi-factor authentication (MFA) challenges.

Supported roles

An API key gives your application the same permissions as the MASV user from which it was created. Users with these roles can create API keys:

• Owner
• Admin
• Custom role with API permissions

Admins can manage only the API keys they create, Owners have full access to manage all API keys for the Team, and Custom roles vary according their permission settings. To learn more about user roles and permissions, see Roles and permissions in MASV.

Create an API key

Create and manage API keys in the MASV Web App. You can create API keys for any Team you belong to.

Note

The API key value is generated automatically and returned only once. It carries the same privileges as the user who created it. Store it securely — you cannot retrieve the key value later.

API key availability depends on your Team’s billing status:

Note

If the Team’s account becomes inactive due to non-payment, MASV suspends the Team’s API keys until account billing is reactivated. Attempting to use a suspended key returns error 402 unauthorized. MASV also suspends API keys when a Trial account ends. For details, see pricing.

Use an API key

Supply your API key in the X-API-KEY header on any request to the MASV API.

Example: Listing sent packages

For full package documentation, see Packages.

Method	Route
GET	/teams/{team_id}/packages

# Store your API key in an environment variable — never hardcode it.
# See /api/api-keys/ for key management best practices.
curl -H "X-API-KEY: $MASV_API_KEY" \
  -H "Content-Type: application/json" \
  -X GET https://api.massive.app/v1/teams/$TEAM_ID/packages

Tip

Rotate your API keys at least every 90 days. If you suspect a key has been compromised, deactivate it immediately, create a new key, and review your Team’s recent API activity.