Authentication

Send the public API key with either of these headers:

• Authorization: Bearer mgapi_live_...
• X-API-Key: mgapi_live_...

Public API keys are server-side credentials. Never expose them in browser code, a WordPress plugin, a desktop client, iframe markup, or a launch URL.

Inspect the authenticated key

Use GET /v1/me to confirm the key scopes and client identity.

curl -X GET "https://api.mortgageguidelines.com/v1/me" \
  -H "Authorization: Bearer mgapi_live_your_key_here"

const response = await fetch("https://api.mortgageguidelines.com/v1/me", {
  headers: {
    Authorization: "Bearer mgapi_live_your_key_here",
  },
});

const data = await response.json();

Header guidance

• Use Authorization when your HTTP client already supports bearer auth helpers.
• Use X-API-Key when you want to avoid bearer-specific middleware.
• Do not send both unless your middleware stack requires it.

Scope catalog

Each endpoint requires the scope shown in the API Reference. Grant only the scopes a key needs:

Use a dedicated launch key with only embed:launch when possible. Keep account deletion on a separately controlled key. Existing keys never receive embed:users:delete automatically; an organization administrator must grant it explicitly.