Authentication

All Monty Mobile APIs authenticate with a secret API key plus your tenant ID, sent as request headers. Keys are scoped to the integration you created and restricted to whitelisted IP addresses.

Required headers

Header	Required	Description	Example
`api-key`	Yes	Secret API token generated in the portal. Keep it confidential.	`<Your_API_Key>`
`Tenant`	Yes	Your organization's tenant UUID, assigned at provisioning.	`<Tenant_ID>`
`Content-Type`	For POST	`application/json` (or `multipart/form-data` for file uploads).	`application/json`

IP whitelisting

The public IPv4 of your calling server must be registered in the portal. Requests from any other source IP are rejected before they reach the API.

Device registration (Push only)

The Push device registration endpoint additionally requires an X-Access-Token and a LanguageCode header.

How X-Access-Token is obtained is not yet documented. Coming soon

Failed authentication

Missing or invalid credentials return an authorization error:

json

{
  "Status": 401,
  "Exception": "Request require authorization!",
  "InnerException": "",
  "StackTrace": "<trace-id>",
  "Code": "-0_0_401"
}