The Spirit of Mithila Developers
Sign in

Authentication

API keys, scopes, test and live mode.

API keys

Create keys in the dashboard and send them as a bearer token over HTTPS:

curl https://developers.vaxhost.com/api/v1/me \
  -H "Authorization: Bearer mth_test_REPLACE_WITH_YOUR_KEY"
  • mth_live_… keys are for production.
  • mth_test_… keys are for development (see Test mode).
  • We show a key once and store only its SHA-256 fingerprint. Lost a key? Revoke it and create a new one.
  • Keep keys on your server. Apps that run on people's devices must use OAuth instead.

Scopes

Each key carries scopes. Calling an endpoint without its scope returns 403 insufficient_scope.

  • profile.read — Your name, email address, verification status and profile photo.
  • catalog.read — Public product, category and seller information.
  • orders.read — Your orders, their items, payment and shipping status.
  • seller.orders.read — Orders placed with your Mithila store, including the delivery address while an order is being fulfilled.
  • seller.orders.write — Mark your store's orders as shipped with the courier and tracking number.

Acting for other people

To read another person's data, they must approve your app through OAuth. Their access token works on the same endpoints, limited to the scopes they approved. OAuth 2.0 & sign in.

Versions

URLs include the major version (/v1). We add fields and endpoints without a new version; breaking changes get a new version and at least 6 months of overlap.