Two headers. One clear brief.
Use a workspace API key and an idempotency key for every write. Keys are never exposed in generated assets.
HEADERAuthorization: Bearer mg_live_…
HEADERIdempotency-Key: launch-001
Readable text stays the invariant.
The API contract is available now. Workspace key issuance and asynchronous status endpoints are still in preview, so unauthenticated writes fail closed.
401Predictable errors
Every failure includes a stable code, request ID, and optional structured details.
{
"code": "UNAUTHORIZED",
"request_id": "req_01J…"
}