Zero-Knowledge Credential Offloading

Delegate API Access With Just 3 Headers

Need to give third-party users or contractors access to your API services? Share access securely using X-MirApi-Key, X-Route-Key, and X-Proxy-Master-Key — without revealing your secret tokens or backend URLs.

✓ Zero code changes ✓ On-the-fly RAM decryption
# Third-party client request (Only 3 Headers Required)
curl --location 'https://proxy.mirapi.io' \
  --header 'X-MirApi-Key: la_3f81f013f002a8d84a37c2e8...' \
  --header 'X-Route-Key: DemoRoute' \
  --header 'X-Proxy-Master-Key: 123456789' \
  --data ''
// JavaScript / Node.js client example
fetch('https://proxy.mirapi.io', {
  method: 'POST',
  headers: {
    'X-MirApi-Key': 'la_3f81f013f002a8d84a37c2e8...',
    'X-Route-Key': 'DemoRoute',
    'X-Proxy-Master-Key': '123456789'
  },
  body: JSON.stringify({ })
});
# Python Requests example
import requests

headers = {
  "X-MirApi-Key": "la_3f81f013f002a8d84a37c2e8...",
  "X-Route-Key": "DemoRoute",
  "X-Proxy-Master-Key": "123456789"
}

res = requests.post("https://proxy.mirapi.io", headers=headers)

The 3 Headers That Secure Your API Access

Clients only need to pass these three parameters. No secret keys or target backend URLs are ever exposed in code.

X-MirApi-Key

1. Client Authorization Key

Authenticates the client against MirApi's high-speed edge cache, enforcing rate limits, usage metrics, and account billing tracking.

X-Route-Key

2. Database Route Identifier

Resolves the pre-configured target backend URL (e.g. Stripe, OpenAI, or internal API) directly from MirApi database rules.

X-Proxy-Master-Key

3. Encrypted Credential Passkey

Decrypts the database-stored API secret in RAM at the edge. MirApi injects the decrypted secret into upstream headers on-the-fly and purges it instantly.

The Danger of Sharing Raw API Keys

Giving external contractors direct access to production secrets is a massive liability. Here is how MirApi neutralizes the risk.

✕
Direct API Key Sharing
  • Sharing live Stripe/OpenAI keys exposes full root access to your paid accounts.
  • SaaS providers limit the number of API keys you can issue or lack granular permissions.
  • Revoking access forces you to rotate keys in production, breaking existing integrations.
✓
Delegated via MirApi 3-Header Proxy
  • Original secrets stay encrypted in DB storage; decrypted only in RAM during request execution.
  • Third-party users only need X-MirApi-Key, X-Route-Key, and X-Proxy-Master-Key.
  • Instantly revoke or rate-limit individual client keys without touching your master API keys.

How MirApi Credential Offloading Works

Three steps to delegate API access safely with zero architecture friction.

1

Configure Route & Encrypted Secret

Define a Route in MirApi Dashboard (e.g. DemoRoute) pointing to your target service URL. Store your vendor API key encrypted in Secured Credentials.

2

Provide 3 Headers to Third Party

Send your client their X-MirApi-Key, target X-Route-Key, and passkey X-Proxy-Master-Key. They never see the original secret key or backend URL.

3

RAM Decryption & Header Stripping

At the edge, MirApi decrypts the key in memory, injects Authorization: Bearer <secret>, strips internal proxy headers, and forwards to upstream.

< 2ms
Internal Latency Overhead
Zero-RAM Leak
Memory Scrubbing Protocol
100%
PCI-DSS Luhn Pre-Validation
10,000
Free Monthly Requests

Protect Your Production Secrets Today

Stop exposing raw API keys. Start delegating secure credentials via MirApi Gateway in less than 2 minutes.

Get Started for Free