Millimetric · Authentication Profile

Millimetric Authentication

Authentication

Millimetric uses Bearer API keys of the form {kind}_{env}_{prefix}_{secret}, modelled on Stripe's pk_/sk_ split. Four key kinds map to two scopes (ingest, read) plus an account-level read variant. pk_* keys are browser-safe and origin-allowlisted; sk_/rk_/ak_ are server-side. Not OAuth — there is no OAuth2/OIDC surface, so there is no scopes/ artifact.

Millimetric secures its APIs with http across 1 declared security scheme, as derived from its OpenAPI definitions.

CompanyAnalyticsWeb AnalyticsProduct AnalyticsAttributionPrivacyMCPAI AgentsEventsDeveloper Tools
Methods: http Schemes: 1 OAuth flows: API key in:

Security Schemes

bearerAuth http
scheme: bearer

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-20'
method: searched
source: https://docs.millimetric.ai/core-concepts/api-keys.md
docs: https://docs.millimetric.ai/core-concepts/api-keys.md
description: >-
  Millimetric uses Bearer API keys of the form {kind}_{env}_{prefix}_{secret}, modelled on
  Stripe's pk_/sk_ split. Four key kinds map to two scopes (ingest, read) plus an
  account-level read variant. pk_* keys are browser-safe and origin-allowlisted; sk_/rk_/ak_
  are server-side. Not OAuth — there is no OAuth2/OIDC surface, so there is no scopes/ artifact.
summary:
  types: [http]
  scheme: bearer
  oauth2_flows: []
  api_key_kinds: [pk_, sk_, rk_, ak_]
  scopes: [ingest, read, account-read]
schemes:
  - name: bearerAuth
    type: http
    scheme: bearer
    format: '{kind}_{env}_{prefix}_{secret}'
    sources: [openapi/millimetric-openapi.yml]
key_kinds:
  - kind: pk_
    scope: ingest
    surface: Browsers, public pages, snippets
    origin_allowlisted: true
    notes: Ingest only. Rejected at /mcp. Requires an Origin header in the project's allowed_origins.
  - kind: sk_
    scope: ingest + read
    surface: Servers, cron jobs, MCP write access
    origin_allowlisted: false
    notes: Required for /v1/forget. Accepted by /mcp.
  - kind: rk_
    scope: read
    surface: Server-side dashboards, MCP clients (recommended)
    notes: Read only (query/stats/sources + MCP read tools). Cannot ingest. Recommended for AI agents.
  - kind: ak_
    scope: account-read
    surface: Account-level MCP (/mcp/account) — agencies, multi-product teams
    plan: Business
    notes: Reads every project the account owns through one credential. Cannot ingest.
storage:
  secret: Shown once at mint; only sha256(secret || pepper) stored. Not recoverable.
  prefix: 8-char lookup key, safe to display.
  caching: Worker caches verified keys 5 minutes per instance; revocation takes effect within that window.
  last_used_at: updated on each successful auth.