Changelog

Every account now has a self-service monthly spend cap, configurable from the dashboard’s Billing page. Once your OTP spend for the month hits the cap, further sends are blocked until you raise it or wait for the reset on the 1st of the month — a hard stop against unexpected billing spikes from bugs, abuse, or a runaway integration. You’ll also get an email alert as you approach the limit.

MiniMoth can now act as Supabase Auth’s Send SMS Hook, delivering Supabase’s own OTPs over WhatsApp first with automatic SMS fallback — using MiniMoth’s Indian delivery infrastructure instead of Supabase’s default SMS-only provider. Supabase still owns the full OTP lifecycle (issuing, verifying, and session creation); your application code doesn’t change at all. Configure it from your MiniMoth dashboard by pointing your Supabase project’s Send SMS Hook at your project’s hook URL.

@minimoth/sdk-node wraps the OTP send/verify and session APIs in a typed client for Node.js, Express, and Next.js backends. It handles Indian phone number normalisation, automatic token refresh with request deduplication, and local JWT validation via a cached JWKS public key — so most integrations never need to call the raw REST API directly.

Access tokens are now signed with RS256 using a rotatable key pair, instead of a shared symmetric secret. Public keys are served at GET /.well-known/jwks.json, so SDKs and backends can verify tokens locally — with zero network round trip — instead of calling session/validate for every request. Key rotation is supported without invalidating tokens signed under the previous key.

Every OTP now attempts delivery over WhatsApp first, falling back to SMS automatically within seconds if the WhatsApp API call fails — no configuration needed on your side. Both channels run on MiniMoth’s own WhatsApp Business Account and SMS sender ID, so you never need to register your own. This typically means higher delivery rates and lower cost per OTP than SMS-only providers.

Every project now gets a mm_test_ API key alongside its live mm_live_ key, for integrating without spending real credits or sending real messages. Test-mode OTPs use a fixed code (000000), skip WhatsApp/SMS delivery entirely, and carry a higher rate-limit budget suited to development traffic. The dashboard’s new Playground lets you try the full send → verify flow interactively, without writing any code first.

Refresh tokens now rotate on every use, with a 10-second grace window to tolerate concurrent refresh calls from the same client. Because of this, POST /v1/session/refresh now returns a new refresh_token in its response body — not just a new access_token — and callers must save and use it on the next refresh. Continuing to send the old refresh token after the grace window closes is treated as reuse and revokes the session.

MiniMoth now issues short-lived access tokens alongside long-lived refresh tokens for every verified OTP session. POST /v1/session/validate checks an access token in under a millisecond via cache; POST /v1/session/refresh rotates both tokens; POST /v1/session/logout revokes a session immediately. This replaces a single long-lived token with the access/refresh pattern used by most modern auth systems.