Every request needs two credentials: a tenant API key, which identifies the tenant and its scopes, and the API Management subscription key, which gates the gateway. There is no per-user login.
| x-mba-api-key | mba_… | Tenant + scopes (the auth boundary) |
| Ocp-Apim-Subscription-Key | 4fb0f9a3b14a44e98698e80cef2aebeb | Public gateway key — same for every caller. Gates at APIM (product subscription + rate limiting) and is safe to publish. |
The subscription key is public — reuse this value
Ocp-Apim-Subscription-Key: 4fb0f9a3b14a44e98698e80cef2aebeb on every request. It is not a secret and you do not create it: it is the same for all callers and only enforces the gateway product subscription. The credential that identifies you is the tenant API key (mba_…).Create an API key
Open Settings → API keys (available in every product) and create a key with the scopes the integration needs (least privilege). The full value (mba_…) is shown once.
Send both headers
curl "https://mpp-api-mybusinessapp-san.azure-api.net/studio/v2/customers" \
-H "x-mba-api-key: $MBA_API_KEY" \
-H "Ocp-Apim-Subscription-Key: 4fb0f9a3b14a44e98698e80cef2aebeb"The tenant is taken from the key, never from the request — a product key can only ever read its own tenant. The Studio (system) key is the one exception: it may target another application by adding x-mba-application-id and x-mba-application-type together. Any other key that names a different tenant is rejected 403.
A key carries a set of scopes chosen at creation. A read without the required scope fails and the API names the missing scope — read it and grant exactly that.
{
"success": false,
"message": "API key does not have the required scope: ReadCustomer"
}401 — missing, malformed, expired, or inactive API key.403 — the key lacks the required scope, is outside its IP allowlist, or tried to name another tenant.429 — rate limited (per-key limit set on the key).See Errors for the full list and example payloads.
Security