Mixpanel Authentication: API Keys & Token Security (2026)

Authentication overview

Mixpanel utilizes a straightforward authentication model centered around API Keys and Project Tokens. These credentials are fundamental for interacting with Mixpanel's various APIs, including the Tracking API for event ingestion, the Engage API for user profile management, and the Data Export API for programmatic data retrieval. Unlike more complex schemes like OAuth 2.0, Mixpanel's approach simplifies integration for developers by relying on these unique identifiers to authorize requests from client-side applications, server-side services, or data pipelines.

Understanding the distinction between an API Key and a Project Token is crucial for secure implementation. While both are necessary for authentication, they serve different roles and have varying levels of sensitivity. The API Key is generally used for server-side operations and has broader access, while the Project Token is often embedded in client-side applications for event tracking. All communication with Mixpanel's API endpoints is secured using HTTPS/TLS, which encrypts data in transit and helps protect credentials from interception, consistent with modern web security practices described by the TLS 1.3 specification.

Supported authentication methods

Mixpanel employs two primary authentication methods: API Keys and Project Tokens. Each method is designed for specific use cases and environments.

API Key

The API Key is a unique identifier for your Mixpanel project. It is primarily used for server-side applications and secure environments where the key can be kept confidential. The API Key grants broader access to your Mixpanel project, including the ability to export data, manage user profiles, and send server-side events. Due to its elevated privileges, the API Key should never be exposed in client-side code or public repositories.

Project Token

The Project Token is a public identifier for your Mixpanel project, primarily used for client-side event tracking. This token identifies which Mixpanel project your data should be sent to. While it is less sensitive than the API Key because it does not grant write access to user profiles or data export capabilities, it is still important to manage its exposure carefully to prevent unauthorized data ingestion into your project. Mixpanel SDKs typically utilize the Project Token directly for client-side tracking.

Here's a comparison of the authentication methods:

Getting your credentials

To obtain your Mixpanel API Key and Project Token, you need access to your Mixpanel project settings. Both credentials are generated automatically upon project creation and are accessible through the Mixpanel user interface.

1. Log in to Mixpanel: Navigate to the Mixpanel dashboard using your administrative credentials.
2. Select your Project: If you have multiple projects, ensure you've selected the correct one from the project dropdown menu.
3. Access Project Settings: Go to the Project Settings. The exact path may vary slightly with UI updates, but typically it's found under a gear icon or a 'Settings' link.
4. Locate Project Token and API Key: Within Project Settings, you will find sections displaying your Project Token and API Key. The API Key is sometimes referred to as 'API Secret' or 'Project Secret' in older documentation or specific contexts, but its function remains the same. Make sure to copy these values accurately.

Mixpanel also provides a detailed guide on finding your credentials within their documentation.

Authenticated request example

Authenticating requests with Mixpanel typically involves including your Project Token or API Key in the request body or as a query parameter, depending on the API endpoint and method. For client-side tracking, Mixpanel's SDKs abstract much of this complexity. However, for direct API calls, particularly for server-side operations or data export, you'll need to explicitly include the credentials.

Example: Tracking an Event (Client-side with JavaScript SDK)

When using the JavaScript SDK, you initialize Mixpanel with your Project Token. The SDK then handles the inclusion of this token in subsequent tracking requests automatically.

mixpanel.init('YOUR_PROJECT_TOKEN', {
    debug: true,
    track_pageview: true
});
mixpanel.track('Signed Up', {
    'Plan': 'Premium',
    'Source': 'Website'
});

Example: Exporting Data (Server-side with cURL and API Key)

For operations requiring your API Key, such as exporting data, you typically pass the key as part of the request. The Data Export API uses HTTP Basic Authentication, where the API Key serves as the username and an empty string as the password, or sometimes as a query parameter depending on the endpoint.

curl \
  -u "YOUR_API_KEY:" \
  "https://mixpanel.com/api/2.0/export/?from_date=2024-01-01&to_date=2024-01-01&event=%5B%22Signed%20Up%22%5D"

In this cURL example, YOUR_API_KEY: is passed with the -u flag for HTTP Basic Authentication, where the colon signifies an empty password. This is a common pattern for APIs that use a single token for authentication, as documented in MDN Web Docs on HTTP authentication.

Security best practices

Securing your Mixpanel credentials is paramount to maintaining data integrity and preventing unauthorized access to your analytics. Adhering to these best practices helps protect your project data.

• Never Expose API Keys: Your Mixpanel API Key should strictly remain on your server or in secure backend environments. Do not embed it in client-side code (JavaScript, mobile apps), public repositories, or commit it directly to source control without encryption or environment variable usage.
• Use Environment Variables: For server-side applications, store your API Key in environment variables rather than hardcoding it directly into your application code. This practice prevents the key from being exposed if your code repository is compromised and allows for easier rotation.
• Restrict Access: Limit who has access to your Mixpanel project settings where API Keys and Project Tokens are displayed. Follow the principle of least privilege, granting access only to those who require it for their roles.
• Rotate Keys Periodically: Although Mixpanel doesn't enforce key rotation, it's a good security practice to periodically regenerate your API Key, especially after personnel changes or suspected compromises. This minimizes the window of opportunity for attackers if a key is leaked.
• Monitor API Usage: Regularly review your Mixpanel API usage logs for any unusual activity or spikes that could indicate unauthorized access or misuse of your credentials.
• Secure Client-side Tracking: While Project Tokens are less sensitive, ensure that your client-side implementation uses HTTPS to encrypt all data sent to Mixpanel. This prevents tokens and event data from being intercepted in transit.
• Avoid Hardcoding in Client Bundles: Even for Project Tokens, consider using build-time environment variables or a configuration service to inject the token into client-side bundles, rather than hardcoding it directly. This provides flexibility and a minor layer of obfuscation.
• Implement Content Security Policy (CSP): For web applications, a robust Content Security Policy can help mitigate risks associated with cross-site scripting (XSS) attacks that might attempt to steal client-side tokens or inject malicious scripts. Ensure your CSP allows connections to Mixpanel's domains.