Core Fields — API keys

API keys (a.k.a. access tokens) are how external consumers and integrators authenticate against Mockomat's runtime and management APIs. Each key belongs to one project, carries a scope that controls what it's allowed to do, and an optional expiry that auto-revokes it on a deadline. The mock API of every project in an account answers only to a key of that project, sent as Authorization: Bearer mck_… (or in the X-API-Key header); a key used on another project's slug gets 404 PROJECT_NOT_FOUND.

TIP

For the how-to side of authentication, see Integrators.

---

API keys (api_keys)

name

string · required

Human-readable label shown in the keys list — e.g. Production mobile app, CI pipeline, Local dev. For your team's bookkeeping; never exposed to the consumer of the key. Renaming is safe.

scope

enum · required · default RUNTIME

What the key is allowed to do. Each scope is strictly additive — pick the narrowest scope that still does the job.

• RUNTIME (default) — query the mock API at POST /mock/<slug>/graphql only. Cannot read or write project metadata. Suitable for the consumer-facing app or library that just needs mock data at runtime.
• MANAGEMENT — read and write project metadata (tables, attributes, relations, views) via the GraphQL management API. Cannot call the runtime endpoint (403 API_KEY_SCOPE_INSUFFICIENT). Suitable for CI scripts or external tools that maintain the model.
• FULL — everything RUNTIME and MANAGEMENT allow combined. Use sparingly; most integrations only need one of the two.

expires_at

datetime · optional

When set, the key is auto-revoked at this moment — the authentication layer rejects requests with an expired key (401 API_KEY_EXPIRED) without needing any explicit action; a revoked key gets 401 API_KEY_INVALID. Leave empty for a key that stays valid until manually revoked. Best practice: set a date for any key used outside your trusted production environment.