Micetro lets you use API keys, which act as secret credentials, to authenticate and automate access to the Micetro API. API keys should be treated like passwords: stored securely and only shared when necessary.
API keys should not be used to authenticate active user accounts, but rather for automation like scripts, recurring scheduled tasks, and integrations that need to call the Micetro API without storing a username and password. For each automation, we recommend using a unique, dedicated API key. Using unique automation accounts helps to limit the impact of mistakes, improves audit clarity, and reduces the risk that a misused key could appear to be actions taken by a human user.
API keys are connected to users, which you should create specifically for the automation tasks. When you add a new API key for a user, it inherits the access permissions associated with the user. As a result, it only has permissions to perform tasks available to the user.
Make sure to set an expiration date for every API key you create and rotate them regularly. The default API key validity period is one year. If the automation is temporary or sensitive, you may want to set a shorter expiration date.
To authenticate with an API key, add it to the HTTP Authorization header as a Bearer token. It is not recommended to hard-code API keys in scripts, logs, or documentation. Where possible, use secret storage or environment variables instead.