Public vs private API keys
Public API keys are:
- prefixed with
pub_ - scoped to a particular site in your organization
- only able to retrieve published content
- designed to be used by a front end application
Private API keys are:
- prefixed with
priv_ - scoped to your organization
- able to perform any action, including destructive ones
- should never be committed to a code repository
- should not be used, or available, on the client
How to create an API key
Create an API key by going to Settings -> API keys.
Neither can be retrieved from the Minima UI once they have been created.
minima auth signup mints a private key too, without the
dashboard. It is an ordinary Admin key named after the machine that asked for
it, it is listed on the same page, and it is revoked the same way — signing in
from a second machine mints a second key, so revoking one does not affect the
other.
These prefixes have been chosen specifically to make it obvious what you’re dealing with.