Authentication with API keys and Clerk JWT - Supercosmos for Platforms

API keys

All Supercosmos for Platforms API endpoints (/v1/laas/*) require an API key sent in the X-Mippo-API-Key header.

curl https://api.mippo.io/v1/laas/kyc/submit \
  -H "X-Mippo-API-Key: sk_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{ "cpf": "123.456.789-09", "biometricHash": "sha256:abc" }'

Key formats

Prefix	Environment	Use
`sk_live_`	Production	Real BRL, real KYC
`sk_test_`	Sandbox	Simulated payments, test KYC

Generating keys

Sign in to your developer dashboard
Click Generate key
Copy the raw key — it is shown once only (Stripe-style)

Treat API keys like passwords. Never commit them to source control. Rotate immediately if exposed. All API calls must originate from your backend — never your frontend.

Developer dashboard auth (Clerk JWT)

Account management endpoints (/laas/partner/*) use Clerk JWT authentication via your existing Supercosmos login session. These are called by the Next.js frontend proxy, not from your integration code.

Errors

Code	Meaning
`401`	Missing or invalid API key
`403`	Key is revoked or your account is suspended
`429`	Rate limit exceeded (100 req/min per key)

All error responses follow:

{
  "success": false,
  "error": {
    "code": "INVALID_API_KEY",
    "message": "The provided API key is invalid or has been revoked."
  }
}