Authentication
Use an API key to authenticate requests to the Makeform REST API. Create a key in your dashboard and send it in the Authorization header.
Create an API key
In the dashboard, go to Settings → API keys (/settings/api-keys). The key is shown once when you create it. You can revoke it there; a revoked key stops working.
You do not need a paid plan to create a key or call the API. Individual features may still require a paid plan.
Choose a key scope
A key’s scope determines which forms it acts on.
| Scope | Access |
|---|---|
user (default) | Your personal forms and team forms where you are an active member |
workspace | One custom workspace. You must be the team owner or an admin, and Makeform checks this on every request |
Every new key also carries the permission scopes makeform:mcp and makeform:api. You cannot choose permission scopes in the UI. These permission scopes are separate from the user and workspace key scopes.
Send the key
Send the key as a bearer token. API keys use the mf_live_ prefix followed by 32 hexadecimal characters.
Authorization: Bearer mf_live_YOUR_API_KEYThe Bearer scheme is case-insensitive.
Headless keys
Headless backend keys start with mfh_live_. They are scoped to one Headless endpoint, are not management credentials, and do not work on the REST API.
Key errors
| Situation | Status | Error name |
|---|---|---|
The request has no Authorization header | 401 | missing_api_key |
| The token is not a Bearer token or is not in API key format | 403 | invalid_api_key |
| The key is revoked or expired, or its owner account is disabled | 403 | disabled_api_key |
OAuth is used by the MCP server; the REST API uses API keys. See MCP authentication.