API keys
Workspace-scoped keys that authenticate the API and the GitHub Action.
Creating a key
In the app, open Settings, then API keys and create a key with a name that says where it
will be used, for example github-actions. The full key starts with mb_live_ and is shown
exactly once at creation; store it in your CI secret store immediately. Afterwards the
app only ever shows the key's prefix.
API keys are available on paid plans. If the workspace drops to the Free plan, keys pause rather than being revoked: requests fail until the workspace is on a paid plan again, then the same keys resume working.
Scope
A key belongs to the workspace and can enqueue runs for any project in it. Every request is also checked against the key creator's membership, so keys created by someone who has left the workspace stop working.
If a key leaks
Revoke it under Settings, then API keys; revocation is immediate. Then create a replacement key and update your CI secrets.
Treat keys like passwords: pass them to CI via the secret store, never inline in workflow files, and never commit them. The GitHub Action is designed so the key is only ever read from a GitHub Secret.