export const headerCode = `headers: {
  'X-Api-Key': 'mm_live_...',
  'Content-Type': 'application/json',
}`

export const sdkAuthCode = `import { MiniMoth } from '@minimoth/sdk-node'

const mm = new MiniMoth({
  apiKey: process.env.MINIMOTH_API_KEY,  // mm_live_...
})
// mm.otp.send(), mm.otp.verify(), etc. attach the header for you`

Every request to the MiniMoth API must include your project's API key in the `X-Api-Key` header:

<CodeBlock code={headerCode} lang="javascript" />

Find or regenerate your key any time from the dashboard under **Project → Settings**. Regenerating a key immediately invalidates the old one.

<div className="mt-6 mb-2">
  <Callout variant="accent">
    <p><span className="text-saffron font-medium">Using Node.js, Express, or Next.js?</span> <a href="https://www.npmjs.com/package/@minimoth/sdk-node" className="text-saffron hover:underline font-mono text-xs">@minimoth/sdk-node</a> attaches the <code className="font-mono text-xs">X-Api-Key</code> header for you — pass the key once to the client instead of setting it on every request:</p>
  </Callout>
</div>

<CodeBlock code={sdkAuthCode} lang="typescript" />

See the [Node.js SDK guide](/docs/sdk-nodejs) for the full API.

## Rate limits

| Endpoint | Live key (`mm_live_`) | Test key (`mm_test_`) |
|---|---|---|
| `POST /v1/otp/send` | 3 per phone per 10 minutes | 20 per phone per 10 minutes |
| `POST /v1/otp/verify` | 5 attempts per OTP, then invalidated | 20 attempts per OTP |
| `POST /v1/session/validate` | 3000 requests/min | 300 requests/min |
| Other `/v1/*` (refresh, logout, status) | 1000 requests/min | 100 requests/min |

---

Full documentation index: https://minimoth.dev/llms.txt