API keys and webhooks: create, limit and revoke

Before you start

• You are the owner or an admin.
• A paid package. The Publishing API is in Pro.
• Someone to put the key into your system — a developer, or a tool such as Zapier or n8n.

Create a key

1. Open API Keys

   Go to Security › Developer, find API Keys and press New key.

2. Name it

   Fill in Key name (for your reference) — for example “Website backend”.

3. Choose what it may do

   On Pro, pick Messaging API — send and receive messages; Publishing API — publish and read; or Publishing API — read only: statuses, numbers, hashtags. On other packages every key is a Messaging API key.

4. Create it and copy the key

   Press Create. The key appears once: Copy this key now — it will only be shown once! Press Copy and keep it in your system’s settings, never in an email or a chat.

Your system sends the key with every request, as Authorization: Bearer mck_live_…xxxx, to https://miragechat.io/api/ext/v1. Open API Manual on the same page lists what you can call.

Limit a publishing key

A publishing key has settings of its own. Create works once the accounts are chosen and the confirmation is ticked.

• Allowed IP addresses — one per line or separated by commas; a range such as 203.0.113.0/24 works too. Empty allows any address — list your server’s.
• Accounts this key may post to — Only the accounts I pick, then tick Instagram, Facebook Page and TikTok accounts; or Every publishing account, including ones connected later.
• TikTok — the default route — Approve in MirageCHAT: the post waits in Instant Post until the owner picks who can see it and taps Post. Send to TikTok Drafts: the video goes to the creator’s TikTok inbox to finish in the TikTok app — up to 5 in 24 hours.
• TikTok direct — optional. Ticked, it adds the route Direct: posted on TikTok at once, without approval in MirageCHAT.
• The confirmation — “Posts sent with this key are published on the selected accounts in my name.” Nothing is created until you tick it.

To change them later, press the pencil on the key’s row and Save. Reaching more accounts asks for the confirmation again. A messaging key has no limits to set.

Rotate or revoke a key

The table shows each key’s name, the start of the key, what it may do, when and from which IP it was last used, when it was made, and its status: Active, Until a time, Replaced, Expired or Revoked.

Send events to your server

1. Subscribe

   Under Outbound Webhooks, press Subscribe to events.

2. Enter your address

   Fill in Endpoint URL — your server’s public address, starting with https:// — and, if you like, a Description.

3. Tick the events

   Under Events to subscribe to, tick at least one. The table below says when each is sent.

4. Create it and copy the secret

   Press Create endpoint. Signing secret — copy now, shown only once: copy it into your server, which uses it to check that each delivery came from MirageCHAT.

5. Send a test

   Press the paper-plane button on the endpoint. You see “Test sent — HTTP 200”, or the reason it failed.

Each delivery is signed in the X-Mirage-Signature header. Verify webhook signatures (Node.js example), at the bottom of the page, shows how to check it. Recent deliveries lists each attempt with its answer and time.

Let the AI call your own API

1. Add a tool

   Under AI Tools — connect your own APIs, press New tool.

2. Describe it

   Give it a Function name (letters, numbers and _) and say When should the AI use it? — for example “whenever the customer asks if dates are free at Seaside Villa”.

3. Point it at your API

   Choose the method, enter Your endpoint URL, any headers your API needs, and the parameters the AI must supply.

4. Save, then test

   Press Create tool, open it again, type sample values and press Test to see your API’s answer.

Good to know

• Each key action is recorded in Security › Activity log: created, changed, rotated and revoked, and every post sent through the Publishing API.
• A delivery is tried 3 times, waiting up to 8 seconds each. After 20 failed deliveries in a row, the endpoint is switched off and turns red.
• Private and local addresses are refused. MirageCHAT delivers only to public addresses.
• Moving to Free? Revoke the keys and delete the endpoints you no longer need first — on Free, this page shows only the package card.

If something looks wrong

On your phone

Owners and admins open Menu › Security in the app and the Developer tab: every key is listed, rotated and revoked there, a messaging key can be created, and webhooks and AI tools work as on the web. Publishing keys are created and changed on the web.

Still stuck? Write to info@miragechat.io with your workspace name. Never send passwords or codes.