Docs/Authentication

Authentication

Authenticate with your API key one of two ways. Get a key from the developer dashboard - free, no card required, with 300 credits every month.

1. Authorization header - recommended for server-side code

{
  "url":          "https://stripe.com",
  "selector":     "section.hero-section-container",
  "autoDetected": true,
  "sections": [
    { "selector": "section.hero-section-container", "label": "Financial infrastructure…", "elements": 343 },
    { "selector": "section.business-sizes-section", "label": "Powering businesses of all sizes.", "elements": 604 },
    …
  ],
  "framework":    "tailwind",
  "code":         "<section class=\"relative w-full\">\n  <h1 class=\"text-[#000000] …\">…</h1>\n</section>",
  "css":          null,
  "tokens": {
    "colors":       ["#000000", "#533afd"],
    "fontFamilies": ["sohne-var"],
    "fontSizes":    ["48px", "16px"],
    "spacing":      ["16px", "24px"],
    "radii":        ["8px"],
    "shadows":      ["0 2px 4px rgba(0,0,0,.1)"]
  },
  "theme":   "light",
  "assets":  { "images": ["https://…/hero.png"], "fonts": [] },
  "summary": { "elements": 42, "declarations": 310, "mappedToTailwind": 180, "arbitrary": 44, "styledCoverage": 97, "repeatedGroups": 1, "truncated": false },
  "usage":   { "creditsSpent": 25, "creditsThisMonth": 25, "monthlyLimit": 100, "remaining": 75, "cached": false }
}

Header

2. access_key query param - handy in the browser and for quick tests

curl "https://miromiro.app/api/v1/code?url=stripe.com&framework=jsx" \
  -H "Authorization: Bearer $MIROMIRO_API_KEY"

# Client-rendered site (React, Next, SPA)? Add render=true to run its
# JavaScript in a real browser first (+5 credits):
curl "https://miromiro.app/api/v1/code?url=stripe.com&framework=jsx&render=true" \
  -H "Authorization: Bearer $MIROMIRO_API_KEY"

URL

Keys in the URL can end up in server, proxy, and browser logs - prefer the header for backend integrations, and rotate a key in the dashboard if you suspect it leaked. If both are sent, the header wins.

Keys are mm_live_ followed by 48 hex characters. Only a SHA-256 hash is stored server-side - the full key is shown once at creation, and can be rotated or revoked in the dashboard at any time. A missing or invalid key returns 401; a key whose subscription is past due or canceled returns 402.

Credits are weighted by endpoint (an asset scrape costs less than a full token extraction - see each endpoint's badge). Failed and blocked requests are never billed, and repeating an identical request within 24 hours is served from cache at no cost.

← PreviousIntroduction Next →Quickstart