Project ID & API keys

Every SDK, CLI, and MCP call needs a project ID plus an API key. Both appear after you create a project on Setup → Verify (API key) or Projects (Project ID chip) — not under Settings (BYOK keys are for your own LLM providers).

API key scopes

Keys are scoped at mint time. Use separate keys for SDK ingest vs IDE/MCP — never give your app’s report:write key mcp:write.

Scope	Used by	Can do
`report:write`	Web/React/RN SDK, CI ingest	Submit bug reports, SDK heartbeat
`mcp:read`	Cursor MCP (read-only)	List reports, `get_fix_context`, lessons, docs search
`mcp:write`	Cursor MCP (full), CLI fix dispatch	Everything in read + `dispatch_fix`, `merge_fix`, QA triggers

MCP brings its own intelligence — you do not need a separate OpenAI or Anthropic key for Mushi MCP tools. You still need a Mushi project + MCP-scoped API key.

Project ID

Your project identifier is a UUID assigned at create time:

Format	Example	Where you see it
UUID	`542b34e0-…`	Success panel + Projects page chip — copy immediately after Create
`proj_…` (future)	`proj_myapp_prod`	Reserved short-form; CLI accepts either shape

Use the UUID from the success panel for mushi init --project-id and SDK env vars.

API key

Secret used to authenticate ingest and admin API calls. Every key has the same format, whichever surface uses it: mushi_ followed by 32 hex characters (for example mushi_3f9a…). The console, the CLI and the MCP sign-in all mint this one format; if an older guide shows a different prefix, read it as mushi_….

Format	Used by	What tells keys apart
`mushi_…`	Web, React, React Native, Capacitor, native SDKs, Node, CLI, MCP	The scopes chosen at mint time (table above), not the prefix

The SDK key and the MCP key look identical, so label them when you store them. An app bundle (web, React Native, Capacitor, native) should carry a report:write-only key; keep mcp:* keys in your editor and CI.

Never commit API keys. The CLI writes SDK keys to .env.local, CLI config to ~/.config/mushi/config.json on macOS and Linux or %APPDATA%\mushi\config.json on Windows ($XDG_CONFIG_HOME/mushi/config.json on any platform when that variable is set; legacy ~/.mushirc is auto-migrated on first load), and adds .cursor/mcp.json to .gitignore when wiring Cursor.

See examples/sdk.env.example for a copy-paste template.

API endpoint

Default cloud endpoint (when unset):


https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api

Self-hosted and staging installs override via apiEndpoint / MUSHI_API_ENDPOINT. The CLI also accepts https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api as an alias.

Environment variable names

Stack	Project ID	API key
Vite / Vue / Svelte / Angular / RN	`VITE_MUSHI_PROJECT_ID`	`VITE_MUSHI_API_KEY`
Next.js	`NEXT_PUBLIC_MUSHI_PROJECT_ID`	`NEXT_PUBLIC_MUSHI_API_KEY`
Nuxt	`NUXT_PUBLIC_MUSHI_PROJECT_ID`	`NUXT_PUBLIC_MUSHI_API_KEY`
Node (Express / Fastify / Hono)	`MUSHI_PROJECT_ID`	`MUSHI_API_KEY`
CLI / MCP	`MUSHI_PROJECT_ID`	`MUSHI_API_KEY`

Run npx mushi-mushi to auto-detect your framework and write the correct prefix.