Organization API keys let an external tool or service authenticate to Mindsmith without using a person’s login session. They are workspace-level credentials: anyone who has the full value can act with the access available to that key, so store them like a password.
The API keys settings tab is available to organization Admins on Business and Enterprise workspaces when the public API feature is enabled.
Create an API key
Open Settings and Members.
Select API keys.
Select Create key and reauthenticate if prompted.
Enter a recognizable name, such as the tool and environment that will use it.
Choose Never, 90 days, or 1 year for the expiration.
Create the key and copy it before closing the dialog.
The full key is shown only once. Mindsmith later displays only a preview, so losing the value requires creating a replacement key.
An organization can have up to 10 active, unexpired API keys. Use separate keys for separate tools, services, or environments so you can rotate or revoke one without interrupting the others.
Authenticate a request
For /api/public/v1 routes, send the key in the HTTP authorization header:
Authorization: Bearer <key>
Use the base domain for the region where the Mindsmith organization is hosted:
US:
https://app.mindsmith.aiEU:
https://eu.mindsmith.ai
The public API currently supports:
Listing, creating, viewing, renaming, and deleting projects and folders
Reading lesson details and exporting lesson content as Markdown
Downloading a lesson as XLIFF and uploading an XLIFF translation for a specific language
The same API key can also create a prefilled lesson-generation link, copy a lesson into its organization, and read or change the organization’s outbound webhook URL. It does not provide a general headless lesson-generation or lesson-editing endpoint. An API key is limited to its own organization.
API keys and MCP access
The same organization key can authenticate to the regional Mindsmith MCP server at /api/mcp, but API-key MCP connections are deliberately read-only. MCP write tools require user-bound OAuth authorization so Mindsmith can attribute created or changed content to a real user.
If an AI tool needs to create or edit content through MCP, connect with OAuth and grant Write access on the Mindsmith authorization screen. See Connect Mindsmith to an AI Tool with MCP for that flow.
Review and revoke keys
The API-key list shows each key’s:
Name and partial preview
Active, expired, or revoked status
Creator and creation date
Last-used date
Expiration date
Select Revoke key when a tool or service no longer needs access or when a key may have been exposed. Reauthenticate if prompted, then type the key's name to confirm. Revocation takes effect immediately and breaks requests that still use that key.
For planned rotation, create and securely install the replacement first, verify that the tool or service is using it, and then revoke the old key.
Keep API keys safe
Never paste a key into a lesson, prompt, support ticket, or shared document.
Do not commit a key to source control or expose it in browser-side code.
Store it in the tool’s secret manager or protected server environment.
Prefer an expiration date and rotate keys on a regular schedule.
Revoke unused keys instead of leaving them available "just in case."