minimothAPI Reference
Base URL: https://api.minimoth.dev. Every /v1/* request needs your project’s API key in the X-Api-Key header — see Authentication for how to send it, and for the full rate-limit table.
OTP
| Method | Endpoint | Description | Details |
|---|---|---|---|
POST |
/v1/otp/send |
Send an OTP to a phone number. Tries WhatsApp first, falls back to SMS automatically. | Quickstart → |
GET |
/v1/otp/status/:otp_id |
Check delivery status of a previously sent OTP. Optional — you can verify directly without polling this first. | Quickstart → |
POST |
/v1/otp/verify |
Verify the code the user entered. Returns an access token and refresh token on success. | Quickstart → |
Session
| Method | Endpoint | Description | Details |
|---|---|---|---|
POST |
/v1/session/validate |
Check whether an access token is still valid. Fast enough to call on every authenticated request. | Sessions → |
POST |
/v1/session/refresh |
Exchange a refresh token for a new access + refresh token pair. Always replace both. | Sessions → |
POST |
/v1/session/logout |
Revoke a session’s refresh token and its current access token. | Sessions → |
Node.js SDK
@minimoth/sdk-node wraps every endpoint above — mm.otp.send(), mm.otp.verify(), mm.session.validate(), and the rest — and handles the parts you’d otherwise write yourself: it attaches your API key to every request, silently refreshes an expired session for you (safeValidate), and lets you configure where refresh tokens are stored (in-memory by default, Redis-backed for multi-replica deployments). Validation itself is configurable too — from instant (local JWT check, zero network round trip) to strict (revocation checked on every call) with cached in-between modes — see validateMode for the full comparison.
Identity
Recognise the same phone number across logins. Both lookup and delete are off by default per project — turn them on from the project’s Identity settings card in the dashboard first.
| Method | Endpoint | Description | Details |
|---|---|---|---|
GET |
/v1/identity/:id |
Look up an identity by its id. | Identity → |
GET |
/v1/identity?phone= |
Look up an identity by phone number (exact match). | Identity → |
DELETE |
/v1/identity/:id |
Hard-delete an identity and revoke every session tied to it. | Identity → |
Public key
| Method | Endpoint | Description | Details |
|---|---|---|---|
GET |
/.well-known/jwks.json |
MiniMoth’s public signing keys, for verifying access tokens locally without a network round trip per request. No API key needed. | Sessions → |
See Error Codes for what each endpoint returns on failure, or Recipes for common integration patterns.
Try the full OTP flow interactively in the sandbox — no SMS sent, no credits consumed. The same Playground also has a live test to send a real OTP to your phone (uses your credits).
Test in Playground →