Developer · API keys

Create an API key without exposing your business credentials.

Private API keys belong in trusted server-side applications. Never put a private MAY API key into browser JavaScript, a public widget snippet, a document or a prompt.

Create a key in Business Admin

  1. Sign in to your MAY Business Admin.
  2. Open Developer from the left navigation.
  3. Open the API credentials / API key controls available for your business.
  4. Create a new key for the application or integration that needs access.
  5. Copy the secret when it is shown and store it securely.
Why the wording says “API credentials / API key controls”

The exact control label can differ by deployed MAY version. The Developer area is the authoritative place to create and manage credentials for the current environment.

Store the key safely

.env
MAY_API_BASE=https://api.thisismay.ai
MAY_API_KEY=replace_with_your_private_key

Use the key from your backend

curl pattern
curl "$MAY_API_BASE/YOUR_ENDPOINT" \
  -H "Authorization: Bearer $MAY_API_KEY" \
  -H "Content-Type: application/json"
Node.js pattern
const response = await fetch(`${process.env.MAY_API_BASE}/YOUR_ENDPOINT`, {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.MAY_API_KEY}`,
    "Content-Type": "application/json"
  }
});

if (!response.ok) throw new Error(`MAY API ${response.status}`);
const data = await response.json();

Rotate or revoke

Create separate keys for separate applications where possible. Revoke a key when an integration is retired or when the credential may have been exposed. Update the secret in your application before removing the old key.

Never use a private API key in browser code

Public website experiences should use the MAY widget configuration generated for that website, not a private server API key. See the Website Widget guide.

Need help implementing MAY?

Use the guide, then configure it in Business Admin.

Open Business AdminContact MAY