API Keys

​

Overview

• It acts as you. Requests authenticated with a key see and do exactly what you, the host who created it, can see and do in the Network, limited to the scopes you granted the key.
• It never expires. A key keeps working until you revoke it.
• It’s shown once. The key value is displayed only when you create it and can’t be retrieved again. If you lose it, create another and revoke the old one.

​

When to use an API key

• Scripts and scheduled jobs that sync members, posts, or events to another system
• Data exports and reporting pipelines
• Back-office automations and internal tools only you operate
• AI agents or integrations you run on your own infrastructure that should act as you

​

Create an API key

​

Scopes

• Write scopes include their matching read. A host:write:network_posts grant also satisfies anything that requires host:read:network_posts.
• A key never exceeds your access. It can do only what you can do as a host, and of that, only what its scopes cover.
• Grant the least you need. Because a key never expires, the scopes you choose are the access anyone holding it has for as long as it exists. Create one key per integration, each with its own narrow scope set, so you can revoke one without breaking the others.

​

Use an API key

curl https://api.mn.co/networks/my-community/graphql \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "query { me { id name } }"
  }'

const NETWORK = 'my-community';

const response = await fetch(
  `https://api.mn.co/networks/${NETWORK}/graphql`,
  {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.MIGHTY_API_KEY}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      query: `query { me { id name } }`
    })
  }
);

const { data, errors } = await response.json();

import os
import requests

NETWORK = "my-community"

response = requests.post(
    f"https://api.mn.co/networks/{NETWORK}/graphql",
    headers={
        "Authorization": f"Bearer {os.environ['MIGHTY_API_KEY']}",
        "Content-Type": "application/json"
    },
    json={"query": "query { me { id name } }"}
)

payload = response.json()

​

Revoke an API key

1. Go to Network Admin > Integrations > Mighty API.
2. In the API keys card, find the key and click the trash icon in its row.
3. Confirm with Revoke.

​

Security and limits

• Keys follow your host role. On every request, Mighty checks that the key’s creator is still a host of the Network and that their account is in good standing. If they’re no longer a host, or their account is banned or removed, requests with the key fail even though the key hasn’t been revoked. Revoke a person’s keys when they leave the host role, and have the integration’s new owner create their own.
• Every authentication failure looks the same. A malformed key, a revoked key, a key used against the wrong Network, and a key whose creator is no longer a host all return the same 401 Unauthorized response.
• Member emails depend on the plan and consent. Another member’s Member.email is null unless the Network’s plan shows member emails to hosts. On a Network without SSO, the field returns an empty string ("") when the member hasn’t agreed to share their email address. SSO Networks don’t require that sharing consent, but the plan and scope rules still apply.
• Scopes control email masking. When another member’s email has a value, a key returns it in plain text only with host:read:network, host:read:network_members, or host:write:network_members; otherwise it is obfuscated. An OAuth token acting as a host needs read:userinfo to return a visible address in plain text; host scopes alone don’t unmask it.
• Your own email bypasses the plan and sharing-consent checks for keys. Your address (me { email }) is available through a key on any plan. The same key scope rule determines whether it is plain text or obfuscated.
• Keep keys server-side. Store keys in a secrets manager. Never put one in client-side code, a mobile or desktop app, a browser bundle, a log, or version control. If a key may have leaked, revoke it and create a replacement.

​

Next steps