#Authentication

Send your API key as a bearer token on every request:

text

Authorization: Bearer sk_live_...

#Keys

Create, list and revoke keys in the console, or with POST /v1/keys, GET /v1/keys and POST /v1/keys/{id}/revoke.
A key is returned once, at creation. Mittis stores only a hash, so a lost key cannot be recovered: revoke it and create a new one.
mode is live (default) or test. Live keys start with sk_live_, test keys with sk_test_. See Test mode.
Test keys cannot mint live keys.
Keep keys on your server. Never ship one in a browser bundle or mobile app.

bash

curl https://api.mittis.ai/v1/keys \
  -H "Authorization: Bearer $MITTIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Production server", "mode": "live" }'

A missing, malformed, revoked or unknown key returns 401 unauthorized. A valid key that may not perform the action returns 403 forbidden.

#Agencies and sub-accounts

An agency key manages child accounts under /v1/subaccounts and /v1/agency/*. To run the rest of the API (numbers, messages, webhooks and so on) as one sub-account, send the agency key plus a header naming it:

text

Authorization: Bearer sk_live_...
Mittis-Subaccount: <sub-account id>

Agency-level routes reject that header. A sub-account that is not your direct child returns 403. In the SDK, mittis.subaccount(id) returns a client scoped to that sub-account.

#Rate limits

Requests are rate limited per account. Exceeding the limit returns 429 rate_limited: back off and retry.