Authorization Guide

Mimeeq has two APIs for server integrations, each with a different purpose:

• Admin API — work with your overall Mimeeq setup and administrative data, including catalog organization, global option sets, pricing data, companies, contacts, and quotations. Supported read and write operations vary by resource; see the live reference.
• Embed API — bring products customized by users into your business workflows. Retrieve their full configuration details for use in ecommerce, order processing, or other downstream systems. You can also retrieve calculated prices, list available products, and generate configuration short codes. It works with configured product data rather than managing account settings or product setup.

For example, maintaining a shared option set belongs to the Admin API; retrieving a customer's selected options and the price of that configuration belongs to the Embed API.

Choose the key that matches the API you call:

API	Base URL	Request header	Key in API Management
Admin API	https://admin.mimeeqapi.com/v1	Authorization: Bearer <admin-key>	Admin API Keys
Embed API	https://mimeeqapi.com	X-API-KEY: <embed-key>	Embed API Keys

API keys authenticate your integration against your customer account. Website visitors sign in separately through mmq-auth or mimeeqAuth; see the Authentication Overview.

Prerequisites

Sign in to the Mimeeq app with access to Settings → Customer settings → API Management. Managing Admin keys requires the API Management permission. If the page is unavailable, or you cannot regenerate an Embed key, ask your account administrator to check your settings permissions.

Open the API Keys tab. It contains separate Admin API Keys and Embed API Keys sections. The other tabs are Requests Log and Documentation.

Generating an API Key

Admin API Keys

1. In Admin API Keys, click Create Admin Key.
2. Enter a descriptive Key Name, such as ERP product sync. You can add a description and a future expiry date.
3. Select only the scopes your integration needs. For example, select products:read to list and retrieve products. Each operation in the Admin API Reference states its required scope.
4. Create the key, then copy it from the Your API key is ready dialog and save it in your server's secrets manager or environment configuration.

Copy the key before closing the dialog

The full Admin key is shown only once. After closing the dialog, the table shows a masked identifier and the last four characters. If you lose the secret, create a replacement key.

You can create separate Admin keys for different integrations. Creating another Admin key does not invalidate existing keys or change your Embed API key.

Embed API key

The API key formerly shown under Customer settings → Account → API is now in API Management → API Keys → Embed API Keys. Copy it using the copy icon beside the masked key.

The move does not change your key, endpoint URLs, or X-API-KEY header. Existing integrations can continue using the same credential. You do not need to create an Admin key to keep using these operations:

Method	Embed endpoint
GET	/get-products-general-info
GET	/get-product-info
GET	/get-product-price-info
POST	/generate-product-short-code

Currently, the Embed API key has account-based access rather than selectable Admin scopes. Resource availability and pricing still depend on the endpoint and your account configuration.

Using the API Key

Admin requests

Store the full Admin key in a server environment variable named MIMEEQ_ADMIN_API_KEY, then send it as a Bearer token:

curl 'https://admin.mimeeqapi.com/v1/products?limit=10' \
  -H "Authorization: Bearer ${MIMEEQ_ADMIN_API_KEY}" \
  -H 'Accept: application/json'

This request requires products:read. See the Admin API Quickstart for the next steps.

Embed requests

Store the Embed API key in a server environment variable named MIMEEQ_EMBED_API_KEY:

curl 'https://mimeeqapi.com/get-products-general-info' \
  -H "X-API-KEY: ${MIMEEQ_EMBED_API_KEY}"

The environment variable names above are examples for your integration. They are not fields in the Mimeeq app. Keep both types of key on your server; do not put them in browser JavaScript, HTML attributes, or public repositories. Browser integrations can call your own authenticated server endpoint, which makes the Mimeeq request.

API Key Scope

Admin keys are limited to their customer account and granted scopes. Scope names are case-sensitive: for example, products:read, companies:write, and globalOptionSets:read.

• A read scope allows the corresponding read operations.
• A write scope also grants read access for the same resource.
• All scopes (*) grants all available scopes. Prefer selecting the scopes needed by each integration.

Scopes do not bypass resource ownership or operation restrictions. Consult the live Admin API Reference for the current scopes and supported operations. If a key needs different scopes, create a replacement with the required access.

Expiry, Revocation, and Rotation

An Admin key can be Active, Expired, or Revoked. If you set an expiry date, requests stop being accepted when that time is reached. Revocation is permanent.

To rotate an Admin key:

1. Create a replacement with the scopes your integration needs.
2. Update the integration's stored secret and verify a request succeeds.
3. Revoke the previous key using its row action. Type REVOKE when prompted and confirm.

If a key has been exposed, revoke it promptly and replace it in affected integrations.

Regenerating the Embed API key

Currently, only one customer Embed API key is active at a time. Regenerate key replaces it immediately. Confirm only when you are ready to update every integration using that key; requests using the previous value will fail authentication. Creating or revoking an Admin key does not regenerate the Embed key.

Authentication Errors

Admin API

Status	Code	What to check
401	unauthenticated	The Authorization header is missing or the Bearer token is malformed.
401	invalid_key	The key is unknown, expired, or revoked. Check the full secret and the API environment.
403	scope_denied	The key lacks the scope required by this operation.
403	operation_not_permitted	The requested operation is not allowed for the resource.
503	auth_lookup_unavailable	Authentication is temporarily unavailable. Retry later.

Admin errors use this shape:

{
  "code": "invalid_key",
  "message": "Invalid API key.",
  "requestId": "example-request-id"
}

Keep the requestId when reporting a problem. The Requests Log can help diagnose calls made with a recognized Admin key. See Admin API Conventions for other errors.

Embed API

Embed endpoints use their existing error format, typically message, code, and payload. Authentication failures can return 401 or 403; /get-product-info can return 400 when the required key header is missing. A 403 does not always mean the key was accepted: an unrecognized key can produce AUTHENTICATION_EXCEPTION.

Check that you copied your Embed API key, sent it as X-API-KEY, and used the Embed host. See the Embed API Reference for each operation's responses.

Next Steps

• Admin API Quickstart
• Admin API Reference
• Embed API Reference
• Requests Log
• Existing API Integrations
• Custom Pricing Integration