Authentication

Learn how to authenticate requests to your mock API endpoints. MockAPI supports multiple authentication methods so you can choose what works best for your application.

How authentication works

Every MockAPI project has a unique API key that authenticates requests to your mock endpoints. Without a valid API key, requests will be rejected. This ensures only authorized clients can access your mock data.

You can find and manage your API key in Settings → API keys from the dashboard sidebar.

Authentication methods

MockAPI supports four ways to include your API key in requests. Choose the method that best fits your application's needs.

1. x-api-key header (recommended)

The simplest and most common method. Include your API key in the x-api-key request header.

cURL

curl -H "x-api-key: YOUR_API_KEY" \
  https://api.mockapi.com/users

JavaScript (fetch)

const response = await fetch('https://api.mockapi.com/users', {
  headers: {
    'x-api-key': 'YOUR_API_KEY',
  },
});

Python (requests)

import requests

response = requests.get(
    'https://api.mockapi.com/users',
    headers={'x-api-key': 'YOUR_API_KEY'}
)

2. Bearer token

Include your API key as a Bearer token in the standard Authorization header. This is compatible with applications that already use Bearer token authentication.

cURL

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.mockapi.com/users

JavaScript (fetch)

const response = await fetch('https://api.mockapi.com/users', {
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY',
  },
});

3. Query parameter

Include your API key as a query parameter. This is useful for simple testing or when you can't set custom headers (e.g., browser URL bar, some webhook integrations).

cURL

curl "https://api.mockapi.com/users?apiKey=YOUR_API_KEY"

Warning

Query parameter authentication exposes your API key in URLs, browser history, and server logs. Avoid this method in production code. Use header-based authentication instead.

4. Request body

Include your API key in the JSON request body. This is useful for POST, PUT, and PATCH requests.

cURL

curl -X POST \
  -H "Content-Type: application/json" \
  -d '{"apiKey": "YOUR_API_KEY", "name": "New User"}' \
  https://api.mockapi.com/users

Method comparison

Method	Best for	Security
x-api-key header	Most applications, recommended default	High (key not in URL)
Bearer token	Apps already using Bearer auth	High (key not in URL)
Query parameter	Quick testing, webhooks	Low (key visible in URL)
Request body	POST/PUT/PATCH requests	Medium (key in request body)

Managing your API key

Finding your API key

Navigate to Settings → API keys in the dashboard sidebar. Your API key is displayed on the page, masked by default for security.

Show/hide: Toggle the key visibility
Copy: Copy the key to your clipboard with one click

Regenerating your API key

If your API key is compromised or you need a fresh key, you can regenerate it from the API keys settings page. Click "Regenerate" and confirm the action.

Warning

Regenerating your API key immediately invalidates the old key. All applications using the old key will stop working until updated with the new key. This action cannot be undone.

Authentication errors

When authentication fails, MockAPI returns standard HTTP error responses:

Status code	Reason	Description
401 Unauthorized	Missing API key	No API key was provided in the request
401 Unauthorized	Invalid API key	The provided API key does not match any project
403 Forbidden	Quota exceeded	Your monthly API call quota has been reached (see Plans & billing)
403 Forbidden	Subscription inactive	Your subscription has expired or been cancelled (see Plans & billing)

Security best practices

Use header-based auth: Prefer the x-api-key header or Bearer token over query parameters to keep your key out of URLs and logs.
Use environment variables: Never hardcode your API key in source code. Store it in environment variables or a secrets manager.
Regenerate if compromised: If your API key is accidentally exposed, regenerate it immediately from the API keys settings.
Rotate keys periodically: Regenerate your API key periodically as a security best practice.

MCP (AI integration)API playground