Mirra
Get Started

Authentication

Learn how to authenticate with the Mirra SDK using API keys

The Mirra SDK uses API keys for authentication. All API requests must include your API key in the X-API-Key header.

Getting your API Key

You can generate an API key from either the web portal or the mobile app:

Option 1: Web Portal

  1. Visit store.getmirra.app/developer/api-keys
  2. Sign in with your Mirra account
  3. Click Generate API Key
  4. Copy the key immediately

Option 2: Mobile App

  1. Open the Mirra app on your phone
  2. Go to SettingsDeveloper
  3. Tap Generate API Key
  4. Copy the key immediately

Your API key is only displayed once when generated. Store it securely. If you lose it, you'll need to revoke it and generate a new one.

API Key Format

Mirra API keys start with the mirra_ prefix:

mirra_a1b2c3d4e5f6789abcdef0123456789...

Using your API Key

Include your API key in the X-API-Key header for API requests:

curl https://api.fxn.world/api/sdk/v1/resources \
  -H "X-API-Key: YOUR_API_KEY"

With the SDK

The SDK handles authentication automatically when initialized with your API key:

import { MirraSDK } from '@mirra-messenger/sdk';
 
const mirra = new MirraSDK({
  apiKey: process.env.MIRRA_API_KEY
});
 
// All SDK calls are automatically authenticated
const resources = await mirra.resources.list();

In application code

Always load your API key from environment variables:

// ✅ Good: Load from environment
const apiKey = process.env.MIRRA_API_KEY;
 
// ❌ Bad: Hardcoded key
const apiKey = 'mirra_a1b2c3d4...';

Python:

import os
import requests
 
headers = {
    'X-API-Key': os.environ['MIRRA_API_KEY'],
    'Content-Type': 'application/json'
}
 
response = requests.get(
    'https://api.fxn.world/api/sdk/v1/resources',
    headers=headers
)

Managing API Keys

Revoking a key

If your API key is compromised or no longer needed, revoke it from the web portal or mobile app (SettingsDeveloper).

Any applications using the revoked key will immediately stop working.

Security best practices

  • Use environment variables: Never hardcode API keys in source code
  • Don't commit keys: Add .env to your .gitignore
  • Rotate regularly: Periodically revoke and regenerate keys
  • Limit exposure: Only share keys with systems that need them
  • Monitor usage: Check the Developer page for last-used timestamps

Troubleshooting

401 Unauthorized

Your API key is missing or invalid.

Check that:

  • The X-API-Key header is included in your request
  • Your API key starts with mirra_
  • The key hasn't been revoked

Invalid API key format

API keys must:

  • Start with mirra_
  • Be the complete key (not truncated)

If your key appears malformed, generate a new one from the Mirra app.

See also

On this page