Authentication

Every request to the MiniMoth API must include your project's API key in the X-Api-Key header:

headers: {
  'X-Api-Key': 'mm_live_...',
  'Content-Type': 'application/json',
}

Find or regenerate your key any time from the dashboard under Project → Settings. Regenerating a key immediately invalidates the old one.

Using Node.js, Express, or Next.js? @minimoth/sdk-node attaches the X-Api-Key header for you — pass the key once to the client instead of setting it on every request:

import { MiniMoth } from '@minimoth/sdk-node'

const mm = new MiniMoth({
  apiKey: process.env.MINIMOTH_API_KEY,  // mm_live_...
})
// mm.otp.send(), mm.otp.verify(), etc. attach the header for you

See the Node.js SDK guide for the full API.

Rate limits

Endpoint	Live key (`mm_live_`)	Test key (`mm_test_`)
POST /v1/otp/send	3 per phone per 10 minutes	20 per phone per 10 minutes
POST /v1/otp/verify	5 attempts per OTP, then invalidated	20 attempts per OTP
POST /v1/session/validate	3000 requests/min	300 requests/min
Other `/v1/*` (refresh, logout, status)	1000 requests/min	100 requests/min

Try the full OTP flow interactively in the sandbox — no SMS sent, no credits consumed. The same Playground also has a live test to send a real OTP to your phone (uses your credits).

Test in Playground →