API Keys & Trace Routing

API keys authenticate your system when sending traces to Mibo. You need at least one to use passive testing.

Each project can have multiple API keys. Keys can be unrestricted (access all agents in the project) or scoped to specific agents.

Email verification and trace access

You can create and revoke API keys before verifying your email. Verification is required when a key sends a trace. Until you verify, Mibo rejects the request with 403 EMAIL_NOT_VERIFIED before storing or evaluating the trace.

To enable trace ingestion, click Resend verification email in the Verify your email banner if needed. Open the link Mibo sends, return to Mibo, and click I’ve verified my email. The key becomes usable for trace ingestion after verification; you do not need to create a replacement key.

If the verification link has expired, resend it and try again. Resending can be temporarily unavailable during the cooldown or a server rate limit, but I’ve verified my email remains available after you open the link. If you verified on another device, return to this dashboard and use the same confirmation action to refresh this session.

Creating an API key

1. Open your project

   Go to the project you want to create a key for.

2. Go to API Keys

   Click API Keys in the project navigation.

3. Create a new key

   Click Create New API Key. Enter a descriptive Key Name, for example, “Production Traces” or “n8n Integration.”

4. Choose access permissions (recommended)

   Choose Full Access to allow the key to send traces for all current and future agents. Choose Granular Access to limit the key to the agents you select. For Your API, a key limited to one agent lets Mibo infer the target, so you can omit platformId. OTLP still uses service.name to select the agent, even when the key is limited to one agent.

5. Choose an expiration

   New keys use 90 days (Recommended) by default. You can choose another preset, set a custom date within one year, or choose Never expires. Short-lived keys are safer for integrations.

6. Copy the key

   The full key is shown only once at creation. Copy it and store it securely. You won’t be able to see it again.

Caution

The full API key is only displayed when you first create it. If you lose it, you’ll need to revoke the key and create a new one.

Key format

API keys follow this format: mibo_<random-string>. When listed in the dashboard, keys are masked as mibo_...xxxx (only the last 4 characters are visible).

Using API keys

Include the key in the x-api-key header when making requests:

curl -X POST "https://api.mibo-ai.com/public/traces" \
  -H "Content-Type: application/json" \
  -H "x-api-key: <YOUR_API_KEY>" \
  -H "x-request-id: chat-001" \
  -d '{ "spans": [{ "span_id": "s-1", "name": "Support Agent", "attributes": { "gen_ai.response.text": "Your order ships on Friday." } }] }'

Agent scoping and routing

When a trace arrives, Mibo resolves its target differently for each ingestion path:

Path	How Mibo selects the agent	What the key scope does
Your API	A key limited to one agent selects it. Otherwise, include platformId at the top level or metadata.mibo.platform_id.	The key must allow the selected agent.
OTLP	service.name must match the agent’s OTLP Service Name. mibo.platform_id is not used for OTLP routing.	The key must allow the agent matched by service.name; it does not replace service.name.

Caution

OTLP still needs service.name with a single-agent key. Set the agent’s OTLP Service Name to the same value as OTEL_SERVICE_NAME in your exporter. A missing service name returns 400 OTLP_SERVICE_NAME_REQUIRED, an unmatched name returns 404 OTLP_PLATFORM_NOT_FOUND, and a key that cannot write to the matched agent returns 403 OTLP_PLATFORM_NOT_ALLOWED.

For Your API, a single-agent key is the simplest way to avoid an explicit agent target. For OTLP, configure the service name first, then make sure the key is allowed to write to that agent.

Revoking a key

Click the revoke button next to any key to permanently delete it. Revoked keys stop working immediately, and any system using that key will start getting authentication errors.

Tip

Rotate your API keys regularly. If a key might be compromised, revoke it immediately and create a new one. The dashboard shows the last used date for each key, so you can identify unused keys that should be cleaned up.

Best practices

• Name your keys descriptively: use names like “Production n8n” or “Staging Traces” so you know what each key is for.
• Scope keys to one agent when using Your API. It eliminates the per-request agent field and limits blast radius if the key is compromised. OTLP still requires its matching service.name.
• Don’t share keys across environments. Create separate keys for staging and production.
• Monitor last used dates. If a key hasn’t been used in a while, consider revoking it.

What’s next

With your API key configured, your system can start sending traces.

Sending TracesDecision matrix: OTLP vs. Your API.

OpenTelemetry (OTLP)Stream traces from any OTel-instrumented stack.

Your APIPOST canonical {spans:[...]} JSON directly.