Authentication

Overview

All requests require your API key as a Bearer token:

text

Authorization: Bearer YOUR_API_KEY

Getting Your API Key

Open Dashboard

Go to app.keymint.dev → Developer → API Keys.

Generate Key

Click Generate Key. Choose a name, scope, and product access.

Save Immediately

Copy your key now. It won't be shown again.

Scopes

API keys have one of three scopes:

Scope	Access
`admin`	Full read/write access to all resources
`client`	Activation, optional first-time licensee claim, device-scoped deactivation, checkout, heartbeat, and checkin. Blocked from detailed key lookup and administrative operations
`read-only`	View-only access — cannot create, modify, or delete

Use client keys for local SDK integrations or device activations where credentials must be bundled. Use read-only keys for detailed license lookups, dashboards, monitoring, or any context where mutations aren't needed.

Usage Examples

bash

curl https://api.keymint.dev/customer \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Error Responses

Response	Cause
`Missing Authorization header`	No `Authorization` header in the request
`Invalid API key`	Key is revoked, expired, or malformed
`Insufficient permissions`	Key lacks the required scope for this endpoint (e.g., using `client` or `read-only` keys for administrative operations)

Security Best Practices

Storage

Store admin and read-only keys in environment variables. Never commit them to source control or embed them in client-side code. Only client keys are intended for bundled runtime activation flows.

bash

# .env
KEYMINT_API_KEY=your_api_key_here

Least Privilege

Use read-only keys wherever possible
Create separate keys per service or environment
Rotate keys every 90 days
Revoke compromised keys immediately