Authentication and modes
Concepts
Authentication and modes
Bearer API keys, test and live modes, key prefixes and good practice for storing them.
The key on every request
Send your key in the Authorization header of every request. Without a key, or with one that doesn't work, the answer is 401.
http
GET /api/v1/ping HTTP/1.1
Host: api.muvon.mx
Authorization: Bearer mvn_test_…Test and live
| Mode | Prefix | What happens |
|---|---|---|
| Test | mvn_test_ | Real prices, but bookings never reach operations or any pilot. Codes TEST-000001. Payments with Stripe test mode. Available once your account is approved. |
| Live | mvn_live_ | Real bookings with code MVN-000123, run and charged by Muvon. Only after Muvon enables live on your account. |
The mode comes only from the key, never from the request. Data never crosses over: a test key doesn't see live bookings, and vice versa. Every response carries a Muvon-Mode: test or Muvon-Mode: live header, and objects carry livemode.
Looking after your keys
- A key is shown in full only when created. Muvon stores a fingerprint, not the key: if you lose it, create another.
- You can have up to 5 active keys per mode. To rotate, create the new one, swap it on your server and revoke the old one.
- Use it only on your server. The API doesn't accept browser calls (no CORS).
- If a key leaks, revoke it in the portal: it stops working at once.
Request id
Every response carries Muvon-Request-Id: req_…. Keep it in your logs and share it with support when something fails.