API Keys & Trace Routing

API keys authenticate your system when sending traces to Mibo. You need at least one to use passive testing.

Each workspace can have multiple API keys. Keys can be unrestricted (access all agents in the workspace) or scoped to specific agents.

Email verification and trace access

You can create and revoke API keys before verifying your email. Verification is required when a key sends a trace. Until you verify, Mibo rejects the request with 403 EMAIL_NOT_VERIFIED before storing or evaluating the trace.

To enable trace ingestion, click Resend verification email in the Verify your email banner if needed. Open the link Mibo sends, return to Mibo, and click I’ve verified my email. The key becomes usable for trace ingestion after verification; you do not need to create a replacement key.

If the verification link has expired, resend it and try again. Resending can be temporarily unavailable during the cooldown or a server rate limit, but I’ve verified my email remains available after you open the link. If you verified on another device, return to this dashboard and use the same confirmation action to refresh this session.

Creating an API key

1. Open Settings

   Click Settings in the sidebar.

2. Go to API Keys

   Click Manage API keys.

3. Create a new key

   Click Create New API Key. Enter a descriptive Key Name, for example, “Production Traces” or “n8n Integration.”

4. Choose access permissions (recommended)

   Choose Full Access to allow the key to send traces for all current and future agents. Choose Granular Access to limit the key to the agents you select. For Your API, a key limited to one agent lets Mibo infer the target, so you can omit platformId. OTLP also routes a single-agent key directly to that Agent.

5. Choose an expiration

   New keys use 90 days (Recommended) by default. You can choose another preset, set a custom date within one year, or choose Never expires. Short-lived keys are safer for integrations.

6. Copy the key

   The full key is shown only once at creation. Copy it and store it securely. You won’t be able to see it again.

Caution

The full API key is only displayed when you first create it. If you lose it, you’ll need to revoke the key and create a new one.

Key format

API keys follow this format: mibo_<random-string>. When listed in the dashboard, keys are masked as mibo_...xxxx (only the last 4 characters are visible).

Using API keys

Include the key in the x-api-key header when making requests:

curl -X POST "https://api.mibo-ai.com/public/traces" \
  -H "Content-Type: application/json" \
  -H "x-api-key: <YOUR_API_KEY>" \
  -H "x-request-id: chat-001" \
  -d '{ "spans": [{ "span_id": "s-1", "name": "Support Agent", "attributes": { "gen_ai.response.text": "Your order ships on Friday." } }] }'

Agent scoping and routing

When a trace arrives, Mibo resolves its target differently for each ingestion path:

Path	How Mibo selects the agent	What the key scope does
Your API	A key limited to one agent selects it. Otherwise, include platformId or metadata.mibo.platform_id, or use the n8n workflow identity.	The key must allow the selected agent.
OTLP	A single-agent key selects that Agent. Other keys match service.name to an allowed Agent’s OTLP Service Name.	A Full Access key creates an Agent for a new service name. It can fall back to the only active non-demo Agent when service.name is unconfigured.

A missing service name without a single-Agent scope or fallback returns 400 OTLP_SERVICE_NAME_REQUIRED. A restricted key with a configured name and no matching Agent returns 400 OTLP_PLATFORM_NOT_FOUND. A multi-Agent key cannot use the fallback.

Revoking a key

Click the revoke button next to any key to permanently delete it. Revoked keys stop working immediately, and any system using that key will start getting authentication errors.

Tip

Rotate your API keys regularly. If a key might be compromised, revoke it immediately and create a new one. The dashboard shows the last used date for each key, so you can identify unused keys that should be cleaned up.

Best practices

• Name your keys descriptively: use names like “Production n8n” or “Staging Traces” so you know what each key is for.
• Scope keys to one agent when using Your API. It eliminates the per-request agent field and limits blast radius if the key is compromised. OTLP also selects that Agent directly.
• Don’t share keys across environments. Create separate keys for staging and production.
• Monitor last used dates. If a key hasn’t been used in a while, consider revoking it.

What’s next

With your API key configured, your system can start sending traces.

Sending TracesDecision matrix: OTLP vs. Your API.

OpenTelemetry (OTLP)Stream traces from any OTel-instrumented stack.

Your APIPOST canonical {spans:[...]} JSON directly.