Skip to main content
Use a stable ID from your application to distinguish end users behind a server-side API key. Keep the key on your server.

Send X-On-Behalf-Of for an end user

Use X-On-Behalf-Of when your server is making a request for one of your end users. Set the header value to your own stable end user identifier.
For example, if your app stores users as user_123, use that value consistently in requests made for that user.
If your integration does not act for a specific end user, omit X-On-Behalf-Of.

Choose the right pattern

Use only Authorization when:
  • You are calling the MKA1 API for your own backend workflow.
  • The request is not tied to a specific end user.
Use both Authorization and X-On-Behalf-Of when:
  • Your server is acting for one of your end users.
  • You want requests, responses, files, or usage to stay associated with that end user.
Do not send an email address or mutable display name unless that is already your stable end user identifier. Use an ID from your own system that does not change.