GETTING STARTED
Authentication
Two credentials exist today, one per endpoint. Both are minted in the product, and both can be rotated without a support ticket.
—Intake tokens — one UUID per lead source, carried in the URL. They are deliberately shareable (they power public forms); deactivating the source kills the token.
—The MeloScan upload key — one per workspace, sent as the x-meloscan-key header. Regenerating it in MeloDocs → Scans invalidates the old one immediately.
There are no workspace API keys yet — anything describing sandbox keys, bearer tokens or key prefixes refers to the full REST API, which isn't live. When it ships, keys will be minted in the workspace settings like everything else.
Updated August 6, 2026Did this page help?
NEXTHow the full API will fit your stack