Authentication and API keys
Create and revoke Maple API keys, choose between a saved key and per-request authentication, and understand browser access for desktop and standalone proxies.
Requests are billed to the account that owns the API key.
Create an API key
Open Settings → API & credits → API Keys in Maple. Create a key and copy it: the full key is shown only once. Give each tool its own key so you can revoke it separately. Delete lost or leaked keys here and create replacements; never commit keys to source control.
Which key is used?
Authorization: Bearer <your-key>takes priority. Use a real Maple key; placeholders override the saved key.- With CORS off, a request that omits Authorization can use the desktop’s saved key or standalone
MAPLE_API_KEY. - With CORS on, every request needs its own key; the saved key is ignored.
/healthneeds no key.
Browser clients and CORS
Enabling CORS permits any website origin. Desktop rejects browser-origin requests when CORS is off; standalone CORS-off is not access control.
Keep a saved key only within a trusted, private boundary: every caller can spend it. For shared or browser-facing proxies, omit the saved key and require per-request keys.
Last updated