API keys

An API key is a token for machines: a script that files entries somewhere, another app that lists your feeds, a backup. It gives the same access as your login, without the password and without expiring.

Making a key

Settings → API keys, give the key a label and create it. The key is shown once; copy it then. Each key can be revoked from the same list, and the plan says how many you may hold (none on the free plan).

Using it

Send the key in the X-Auth-Token header on requests to https://microrss.com/api/reader/…:

curl -H "X-Auth-Token: <key>" https://microrss.com/api/reader/feeds

The resources:

path	what it answers
me	who the key belongs to, the plan and its limits
feeds, feeds/counters	your subscriptions, their unread counts
feeds/<id>/entries, categories/<id>/entries, entries	entries, with status, search, order and published_after as query parameters
entries/<id>	one entry; PUT with {"status": "read"} marks it
entries/<id>/bookmark	toggle the bookmark
mark-all-as-read	a scope read at once
opml	GET downloads your subscriptions, POST imports a file

The shapes follow the Miniflux API where the two overlap, so software written for Miniflux usually needs only the address and the header changed.

Keeping it safe

A key in a leaked script is a key to your account. Revoke it in Settings and make another; changing your password does not revoke keys.