Authentication

Every request needs an API key in the Authorization header:

curl https://connect.mindcloud.co/v2/me \
  -H "Authorization: Bearer $MINDCLOUD_API_KEY"

A key belongs to one company, and every resource you read is scoped to that company automatically. There is nothing to configure per request.

Verify a key

GET /v2/me describes the calling key and its effective scope:

{
  "success": true,
  "data": {
    "apiKey": { "id": "apikey_abc", "name": "Reporting", "companyId": "cmp_123" },
    "companyId": "cmp_123"
  }
}

Key handling

Keep keys on the server and out of client-side code. Keys can be managed entirely over the API: audit them with GET /v2/api-keys, mint new ones with POST /v2/api-keys, and shut one off with DELETE /v2/api-keys/:apiKeyId. A revoked key stops working immediately, and new key material is shown once, in the create response.