Authentication

Sign in

UptimeMonitoring supports three sign-in methods: GitHub OAuth, Google OAuth, and email (a sign-in link or a 6-digit code). No password, for any of the three. See the sign-in guide for the full walkthrough, including how to link a second method to an existing account.

1. Visit app.uptimemonitoring.com
2. Click “Sign in with GitHub”, “Continue with Google”, or enter your email address
3. Authorize the app (GitHub/Google) or follow the emailed link/code
4. You’re in — create your first API key

API key format

All API keys use the umk_live_ prefix followed by a random string:

Authorization: Bearer umk_live_abc123def456...

The prefix makes keys easy to identify in logs and secret scanners.

Multiple keys by environment

Use separate keys for different environments and tools:

• ci-prod — for GitHub Actions and deploy pipelines
• local-dev — for development and testing
• mcp-claude — for your MCP integration
• mcp-cursor — for Cursor

Each account supports up to 10 API keys.

Rotation and grace window

When you rotate a key:

1. A new key is issued immediately
2. The old key remains valid for a 5-minute grace window
3. After grace, the old key is permanently revoked

This prevents downtime during key rotation in automated systems.

Common auth errors

The error envelope is flat: {"error": "<message>"}. Match on the HTTP status; the message is the literal validator output.

Status	Message	Meaning
401	missing authorization	Authorization header absent
401	invalid credentials	API key not recognised or revoked
403	account suspended; contact support	Account suspended (e.g. by the port-scan heuristic). Returned on regular /api/v1/* calls.
403	forbidden	Admin-only route hit by a non-admin caller. Opaque on purpose — does not disclose whether the route exists.

Note: 401 responses currently carry Content-Type: text/plain even though the body is valid JSON. Parse the body as JSON regardless; this discrepancy is being fixed on the API side (see monitive/uptimemonitoring-api).