MARBIN · API guide
Keys and signing in
Every call but /v1/health and the documentation needs a key. Send it in the header, from your server:
curl -H "Authorization: Bearer $MARBIN_KEY" "https://api.marbin.co.uk/v1/universe"
A full key is refused in a web address (?key=): addresses end up in logs. Only a widget key, made for a web page, may ride there, and only from the websites listed on it.
| Key | Starts | Use |
| Full | mk_live_… | your servers; every endpoint your plan and scopes allow |
| Widget | mk_pub_live_… | a web page: screen, purification and zakat only, from its listed websites |
| Sandbox | mk_sandbox_… | every endpoint over fixed sample data; free |
Scopes
A key may be limited to some groups of endpoints; a call outside them gets 403.
| Scope | Endpoints |
shariah | Shariah screen, purification, zakat, the universe, filings |
signals | signals, the model portfolio, the track record |
market | the market and exchange rates |
history | the daily history |
Keeping keys safe
A key is shown once, when it is made; MARBIN keeps only a fingerprint of it. Keep it in your secrets store, never in code, a repository or a browser.
- Rotate (partner portal, API & webhooks): a new key with the same settings works at once; the old one keeps working for the overlap you choose (up to 14 days), then stops. Deploy the new key within the overlap.
- Revoke: the key stops at once -- for a key that may have leaked.
- Last used: the portal shows when each key last made a call; one you don't recognise is a reason to revoke.
Every key change -- yours in the partner portal, or MARBIN's -- is in your bank's audit log.