Authentication

Every v1 request must include a valid API key in the Authorization header.

Create an API key

Generate keys in the developer dashboard. Keys use the mk_ or midas_live_ prefix.

Dashboard → copy key

mk_a1b2c3d4e5f6...
# or
midas_live_a1b2c3d4...

Send the Authorization header

Bearer and raw key formats are both accepted. You can also use X-API-Key.

curl

curl "https://api.midasai.tech/v1/users/me" \
  -H "Authorization: Bearer YOUR_API_KEY"

JavaScript (fetch)

const res = await fetch("https://api.midasai.tech/v1/users/me", {
  headers: {
    Authorization: process.env.MIDASAI_API_KEY,
    // or: Authorization: `Bearer ${process.env.MIDASAI_API_KEY}`,
  },
})
const { data } = await res.json()

Permission scopes

Assign the minimum permissions your integration needs when creating a key.

Common permissions

{
  "read": ["GET /v1/listings", "GET /v1/users/me"],
  "write": ["POST /v1/listings", "PUT /v1/users/me"],
  "delete": ["DELETE /v1/listings/:id"],
  "scoped": ["read:listings", "write:webhooks"]
}

401 — invalid key

Missing or invalid credentials return a JSON error with HTTP 401.

Response

{
  "error": "Missing or invalid API key",
  "hint": "Use Authorization: Bearer YOUR_KEY or X-API-Key header"
}

Security checklist

.env (server-side only)

# Never commit this file
MIDASAI_API_KEY=mk_your_secret_key_here

# Rotate immediately if exposed
# Revoke in dashboard → Developer → API Keys