Skip to main content
This is an Early Access feature. To enable it for your account, please contact your MoEngage Customer Success Manager (CSM) or the Support team.

​
Overview

API keys are typically used as an authentication or authorization mechanism. They are unique identifiers associated with access to API resources. API keys help ensure the security and accountability of API access, allowing you to manage and monitor usage effectively. The multi-API key feature is currently supported for the following API groups:
  • Segmentation APIs and Inform are available only with Basic Auth.
  • Creation of new API keys for Push APIs is not currently supported. Push APIs work only with Basic Auth (Legacy) keys migrated to this dashboard.
To send data to MoEngage, you can use the Workspace ID and key for that particular API. Whenever a key is regenerated, the old key expires immediately and it takes some time for the new key to become functional, which may result in service interruptions. MoEngage provides multiple API keys to help you avoid this situation:
  • Generate a new key while the existing key is still available: With multi-key support, the existing key remains active until the new key becomes functional. This allows you to rotate keys for security purposes without causing downtime. For example, if your team needs time to integrate a new key, the old key continues to work during that period. After the new key is integrated, you can archive the old one.
  • Use different keys for different teams: You can create separate keys for different internal teams or external vendors, each scoped to the APIs they need. This provides granular access control and improves security across your organization.
To restrict which IP addresses can use your keys, see API Firewall.

​
Authentication Types

MoEngage supports two authentication types for API keys:
  • Basic Auth: The standard authentication method using an API key and secret. Suitable for server-to-server integrations where token expiration is not a requirement.
  • OAuth 2.0: A token-based authentication method that issues short-lived access tokens. The token expiry time is customizable, and the backend validates access tokens automatically.

​
Create a Key

  • After the multi-API key feature is enabled, the existing API keys in the API dashboard are migrated to your new API key dashboard as legacy keys.
  • You can view the legacy key (autogenerated previously when the workspace was created and migrated to this new dashboard) details and continue to use them. However, archiving, editing, and regenerating legacy keys is not supported.
  • MoEngage recommends creating and using new keys, as legacy keys will be deprecated in the future.
1

Open the API Keys Page

On the left navigation menu in the MoEngage dashboard, go to Settings > Account > API keys.
2

Start a New Key

Click + Create new key.
Create new key button highlighted on the API Keys page
3

Open the Key Details Form

In the Create new key dialog, enter the key details.
4

Name the Key

Enter a name in the Key name box. The key name must not exceed 100 characters.
5

Choose an Authentication Type

Under Authentication Type, select the method you want to use, then set the options for that method:
Under Select APIs for access, select the API groups you want to access using this key:
  • Data APIs
  • Segmentation APIs
  • Campaigns
  • Inform
  • Offerings
  • Decision Policy
  • Dashboard & Analyze
Image showing the steps to create a new API key in the Create new key dialog of Basic Authentication
6

Scope the API Access

Click next to a group to expand it and select individual APIs. Use Select all or De-select all to manage selections across all groups.
7

Save the New Key

Click Create key. The key is then listed under Active API keys.
To use the key in requests, see Authentication. For per-endpoint request limits and payload caps, see Rate Limits.

​
View Active Keys

On the API Keys page, the Active API keys table shows the following columns: You can search for keys using the search bar. The count of active keys is displayed above the table.
Legacy keys are listed with the auth type Basic Auth (Legacy). You can view and continue to use these keys, but you cannot edit, regenerate, or archive them.

​
Manage Keys

On the API Keys page, click for a key to see the following options:
Key action menu showing View key details, Regenerate key, Edit key details, and Archive key options
The old key expires immediately after regenerating. Replace the old key in your integrations to avoid errors.

​
View Key Details

1

Open the Key Actions Menu

On the API Keys page, click for the key you want to view.
2

Open the Details Panel

Click View key details. The fields in the details panel depend on the authentication type of the key:
From the details panel, you can click Edit key details or Regenerate key to perform those actions.
View key details panel showing key name, API key, authentication type, access token expiration, audit fields, and API access, with the Edit key details and Regenerate key buttons highlighted

​
Edit Key Details

1

Open the Key Actions Menu

On the API Keys page, click for the key you want to edit.
2

Open the Edit Dialog

Click Edit key details.
3

Update the Fields

In the Edit key details dialog, edit the available fields:
4

Save Your Changes

Click Save. The Save button remains disabled until you make a change.

​
View Archived Keys

  1. On the API Keys page, click View archived keys.
  2. The archived keys list opens with the following columns: Key name, Auth type, Archived on, and Key.
Archived keys list showing key name, authentication type, created on, and key columns

​
Audit Logs

Audit logs page showing API key actions
Use Audit Logs to track actions performed in the MoEngage dashboard. The audit logs include all actions related to API keys, so you can identify who performed each action and when. You can do the following in Audit logs:
  • Click to filter audit logs based on Team(s), Action, Actor, and Date time Range.
  • Type a value in the Search logs by search bar to fetch the relevant audit logs.
  • Click Export audit logs to receive the audit log report by email. The email includes a download link for the report.
For all actions related to API keys, the Entity column in Audit logs displays API Keys. The Action column shows the following values:
  • Create is displayed when an API key is created successfully.
  • Update is displayed when:
    • A key name is updated.
    • The API selection for a key is updated.
    • A key is regenerated.
  • Delete is displayed when a key is archived.

​
FAQs

Legacy keys are API keys created automatically when the workspace was created and migrated from the older API keys dashboard to this one. You cannot edit, regenerate, or archive them.
OAuth 2.0 access token expiration is a security feature that limits how long an access token can be used to call protected APIs before it becomes invalid.An access token acts as a temporary digital pass. Instead of sharing your password with every app or service, the authorization server gives you a short-lived token. When that token reaches its expiration time, the API rejects any further requests and returns an HTTP 401 Unauthorized error.
  • Better security: If an attacker steals a short-lived token, they have only a brief window to exploit it before it stops working.
  • Resource control: Expiration prevents unused or abandoned tokens from filling up the authorization server’s database.
  • Standard lifespan: You can set the access token expiration anywhere from 5 to 60 minutes.
MoEngage issues a companion refresh token alongside the access token. Your app uses this longer-lived refresh token in the background to request a fresh access token, without forcing the user to log in again.