Manova Authentication
Where each key comes from, how to send it, and how to keep it safe.
Widget key (public)
Each assistant has a public key, pk_ followed by 32 letters and digits. It goes in the data-bot attribute of the
widget's script tag and is safe to publish: the widget only loads on the domains you allowed for that assistant.
Store connection key (secret)
A shop connected to an assistant uses a connection key:
mnv_<32 hex characters: the store>_<40 characters: the secret>Create it in the assistant's فروشگاه section. Send it as a bearer token on every store API call:
Authorization: Bearer mnv_3f2b...c91a_Xk29...QpThe part after the last underscore is also the secret Manova uses to sign order lookups. Making a new key in the panel stops the old one at once; update your integration with the new key.
API token (secret)
For the chat API. Create one in دسترسی API (/workspace/api) in your workspace.
- A token looks like
manova_followed by 64 hexadecimal characters. - It is shown once, when you create it. Manova stores only a hash.
- It expires 90 days after creation. Create a new one before then.
- You can have up to 5 active tokens. Revoke one from the same page; it stops working immediately.
- A token acts as your account: it uses your credits and sees your conversations.
Authorization: Bearer manova_4c1f...e07bKeep secrets on the server
Store keys and API tokens are full credentials. Do not ship them in browser JavaScript, mobile apps or public repositories. If one leaks, make a new one in the panel; the old one stops working at once.
Failed authentication
A missing, malformed, revoked or expired key gets 401:
{ "code": "UNAUTHENTICATED", "message": "کلید API معتبر نیست." }message is written for people (in Persian). Branch on code. See Errors.