My Vibe Design.Back to the studio
For agents

API keys

Last updated 7 August 2026

One credential type covers both the MCP endpoint and the REST compile endpoint: a long-lived license key prefixed mvd_live_.

How to get one

  • Create an account and upgrade to Pro on the pricing page — API and MCP access is a Pro capability.
  • Open Skill keys from the account menu, name the key after the place it will live (for example cursor-laptop or ci-runner), and generate it.
  • Copy the key immediately. It is shown once and stored only as a hash — we cannot recover it later, only replace it.
  • Store it in your agent's secret store or an environment variable, never in a repository.
export MVD_KEY="mvd_live_…"

curl -X POST https://myvibedesign.kognexity.com/api/public/compile \
  -H "Authorization: Bearer $MVD_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "state": { "mood": ["calm"] }, "dialect": "lovable" }'

What a key grants

  • Scope: compile_vibe_brief — compiling briefs, nothing else. A key cannot read your account, your saved taste profiles, your billing details, or anyone else's data.
  • It is bound to the account that minted it. Usage counts and last-used time are recorded per key so you can spot an unfamiliar caller.
  • Rate limit: 60 requests per minute per key, shared across MCP and REST.

Where a key may be used

  • Allowed: server-side code, CI jobs, a local agent or IDE MCP configuration, a backend proxy you control.
  • Not allowed: browser JavaScript, mobile apps, public notebooks, shared prompts, screenshots or screen shares. Anything a user can view is a leak.
  • Do not pass a key to a third-party service that stores prompts or configuration you cannot audit.

Rotation and revocation

  • Mint a replacement, deploy it, then revoke the old key — revocation takes effect on the next request, with no grace period.
  • Use one key per environment so revoking one never takes down another.
  • Rotate on any staff change, laptop loss, or suspicion of exposure. There is no penalty for rotating often.
  • If we detect a key in public code we revoke it and email the account owner.

If a call is rejected

  • 401 unauthorized — the key is missing, malformed, expired or revoked. Check the header format: Authorization: Bearer mvd_live_….
  • 403 forbidden — the account behind the key is not on a plan that includes API access.
  • 429 rate_limited — honour Retry-After rather than retrying immediately.

Every response carries X-Request-Id. Quote it in the contact form and we can trace the exact call. Endpoint reference lives in the API docs, and the keyless tool overview is on agent tools.