> ## Documentation Index
> Fetch the complete documentation index at: https://laas.mippo.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication with API keys and Clerk JWT

> How platforms authenticate server calls to the Supercosmos for Platforms API with API keys and how the developer dashboard uses Clerk JWT for user session tokens.

## API keys

All Supercosmos for Platforms API endpoints (`/v1/laas/*`) require an API key sent in the `X-Mippo-API-Key` header.

```bash theme={null}
curl https://api.mippo.io/v1/laas/kyc/submit \
  -H "X-Mippo-API-Key: sk_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{ "cpf": "123.456.789-09", "biometricHash": "sha256:abc" }'
```

### Key formats

| Prefix | Environment | Use |
| - | - | - |
| `sk_live_` | Production | Real BRL, real KYC |
| `sk_test_` | Sandbox | Simulated payments, test KYC |

### Generating keys

1. Sign in to your [developer dashboard](https://partners.mippo.io/partner/api-keys)
2. Click **Generate key**
3. Copy the raw key — it is shown **once only** (Stripe-style)

> [!WARNING]
>
> Treat API keys like passwords. Never commit them to source control. Rotate immediately if exposed. All API calls must originate from your backend — never your frontend.

## Developer dashboard auth (Clerk JWT)

Account management endpoints (`/laas/partner/*`) use Clerk JWT authentication via your existing Supercosmos login session. These are called by the Next.js frontend proxy, not from your integration code.

## Errors

| Code | Meaning |
| - | - |
| `401` | Missing or invalid API key |
| `403` | Key is revoked or your account is suspended |
| `429` | Rate limit exceeded (100 req/min per key) |

All error responses follow:

```json theme={null}
{
  "success": false,
  "error": {
    "code": "INVALID_API_KEY",
    "message": "The provided API key is invalid or has been revoked."
  }
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.