Authentication

All API requests (except the registration endpoints) require a Bearer token in the Authorization header.

Header format

Authorization: Bearer mfx_test_abc123...

Key types

Prefix	Scope	Traffic
`mfx_test_`	Sandbox environment	Routed to sandbox. No real faxes sent.
`mfx_live_`	Live environment	Routed to production. Real faxes delivered.
`mfx_acct_`	Account	No fax traffic. Reads the account, balances, and transactions. Manages keys.

The prefix of an environment key (mfx_test_ or mfx_live_) determines routing automatically. There is no separate sandbox URL or environment toggle. See Environments for how isolation works. Use an environment key for /environment/*, /faxes, /webhooks, and /events. Use an mfx_acct_ key for /account/*. A key on the wrong route returns HTTP 403 with key_not_scoped_for_account or key_not_scoped_for_operations. See API keys and scopes for the endpoint table.

Getting your first keys

# Step 1: Start registration (sends a 6-digit code to your email)
curl -X POST https://api.mintfax.com/v1/account/register \
  -H "Content-Type: application/json" \
  -d '{"name": "My App", "email": "dev@example.com"}'

# Step 2: Verify the code from your email
curl -X POST https://api.mintfax.com/v1/account/register/verify \
  -H "Content-Type: application/json" \
  -d '{"email": "dev@example.com", "code": "482901"}'

The verification response carries two keys. Each is shown once, so store both securely:

api_key is your mfx_test_ key. Use it to send sandbox faxes.
api_key_account is your mfx_acct_ key. Use it for /account/* requests, such as creating more keys.

Multiple keys

Each account can have multiple named API keys. Manage them in the dashboard, or through /account/keys with an mfx_acct_ key. Use separate keys for different applications or environments, so you can rotate one without touching the others. POST /account/keys and DELETE /account/keys/{id} do not work on mfx_acct_ keys: both return HTTP 403 with acct_key_creation_dashboard_only. Create and revoke mfx_acct_ keys in the dashboard.

Key rotation

Create a new key with POST /account/keys or in the dashboard, update your application, then revoke the old key with DELETE /account/keys/{id} or in the dashboard. Keys do not expire on their own, so the old key keeps working until you revoke it. Rotate an mfx_acct_ key in the dashboard.

Security

Store keys in environment variables or a secrets manager, not in source code
Use sandbox keys (mfx_test_) during development and testing
Rotate keys immediately if you suspect a leak
Each mfx_test_ or mfx_live_ key is scoped to a single environment
mfx_acct_ keys are scoped to the account and have no environment access

Get Started

Environments

Billing

Errors

Header format

Key types

Getting your first keys

Multiple keys

Key rotation

Security

​Header format

​Key types

​Getting your first keys

​Multiple keys

​Key rotation

​Security

Header format

Key types

Getting your first keys

Multiple keys

Key rotation

Security