API Reference

All tenant API requests require an X-API-Key header. Create an API key from your dashboard. Project is implicit from the key — never in the URL.

Authentication

POST/v1/auth/signup

Create a new end-user account.

{
  "email": "user@example.com",
  "password": "min8chars"
}

Returns user + session_token (mms_...).

POST/v1/auth/login

Authenticate an existing user.

{ "email": "...", "password": "..." }
POST/v1/auth/logout

Invalidate a session. Send the session token as Authorization: Bearer mms_....

GET/v1/auth/me

Get the current user. Requires Authorization: Bearer mms_....

POST/v1/auth/magic-link

Send a passwordless sign-in email.

{ "email": "user@example.com" }
GET/v1/auth/verify?token=x

Verify a magic link token. Returns user + session token.

Documents

POST/v1/collections/{name}/documents

Create a document. Body is any JSON object. Optionally include an id field; otherwise one is auto-generated.

GET/v1/collections/{name}/documents/{id}

Get a single document by ID.

PUT/v1/collections/{name}/documents/{id}

Replace a document entirely.

PATCH/v1/collections/{name}/documents/{id}

Merge fields into a document. Set a field to null to delete it.

DELETE/v1/collections/{name}/documents/{id}

Delete a document.

Query

POST/v1/collections/{name}/query
{
  "filter": {
    "status": "active",
    "age": { "$gte": 21 }
  },
  "sort": [{ "field": "created_at", "order": "desc" }],
  "limit": 20,
  "start_after": "lastDocId"
}

Operators: $eq, $ne, $gt, $gte, $lt, $lte, $in (max 30), $prefix.

Inequality filters work on one field only. Pagination is cursor-based via start_after.

Collections

GET/v1/collections

List all collections in the project.

Scoped Tokens

POST/v1/tokens

Mint a scoped JWT. Requires API key auth (not a scoped token).

{
  "scope": {
    "todos": { "user_id": "abc123" },
    "*": {}
  },
  "ttl": 3600
}

Scope maps collection names to required field filters. Use * for wildcard. Max TTL: 24 hours.

Authentication Model

X-API-Key: mm_... — Identifies the project. Always required.

Authorization: Bearer mms_... — End-user session token (optional, identifies user).

Authorization: Bearer <jwt> — Scoped token (alternative to session, restricts data access).