MantelMarketing API

Most public endpoints need none

Every endpoint documented in the reference grid below is reachable without a Clerk session. Two of them carry a per-row token in the URL — the status confirm and unsubscribe links — and that token is issued during the subscribe flow. Everything else is open by design.

We rate-limit by IP. Contact form submissions cap at three per hour; the domain availability check at sixty per hour; status subscribe at three per hour. If you hit a 429, slow down — there’s no premium tier you can buy out of it; the limit is there to keep the abuse floor low for everyone.

Customer API tokens — Bearer auth on dashboard routes

Customer-facing routes that normally require a Clerk dashboard session — publishing, posting messages, presigning file uploads — also accept a personal access token on the Authorization header. Generate one in your dashboard under API tokens, then call our API from a CI pipeline, Zapier zap, or any other machine context.

Tokens look like mm_pat_ followed by 32 base32 chars. Pass the full string with the Bearer scheme — the scheme name is case-insensitive but the token itself is case-sensitive.

curl -X POST https://mantelmarketing.com/api/publish \
  -H "Authorization: Bearer mm_pat_YOUR_TOKEN_HERE" \
  -H "Content-Type: application/json" \
  -d '{"projectId":"YOUR_PROJECT_UUID"}'

Scopes constrain capabilities. Each token carries a list of scopes chosen at creation. A request fails with 403 if the token lacks the scope its endpoint requires — even when the token’s account would otherwise have permission. The five scopes are:

• publish — required for POST /api/publish.
• messages — required for POST /api/projects/{id}/messages.
• files — required for POST /api/files/presign.
• domain — required for POST /api/domains/purchase. Off by default.
• billing.read — read-only billing endpoints.

We show the plaintext exactly once at creation time. Store it in a secret manager and never commit it to source control. If a token leaks, revoke it from the dashboard — it stops working immediately. Practical guide: Using API tokens.