Authentication
API keys in a header, Google login in the browser, per-key capability profiles, and the credentials that are deliberately kept separate.
Hostnames
https://maximind.dev is the primary hostname. https://maximind.macsvff.uk is the same server and stays supported; every endpoint, key and account works on both names. The public edge adds a 100-second request timeout and a 100 MB body limit.
API keys
Send the key on every request in either header. Both are validated identically; the Bearer prefix is stripped.
x-api-key: <key>
Authorization: Bearer <key>
Two kinds of key exist:
| Key | Who holds it | Rights |
|---|---|---|
| Primary Key | The owner | Admin everywhere, from any network. Actor label Primary Key. |
| Custom key | One per app, site or person | Works from anywhere, restricted by its capability profile. The row's label is the actor; use_count and last_used_at increment on use. |
A revoked custom key is rejected. Missing or invalid key and no session returns 401 {"detail":"Invalid or missing API key"}.
GET /auth-check
curl -s https://maximind.dev/auth-check -H "x-api-key: $MAXIMIND_API_KEY"
{"ok": true}
Per-key capability profiles
Custom keys carry an immutable capability profile that the owner edits at /admin/api-access. Profiles are keyed by the key's id, so renaming a key never detaches its restrictions.
| Capability | Gates |
|---|---|
generate |
POST /api/ai/generate, /v1/chat/completions and attachment (vision) input. |
agent_engines |
Which engines (claude, codex, agy) the key may use. An empty engine list is denied. |
| Agent tasks | Which POST /api/ai/agent tasks the key may run. |
media |
All require_api_key endpoints: transcripts, jobs, scrape, YouTube upload. |
worker_profiles |
Sandboxed worker profiles (research, read_docs). Default empty. |
| Image models | Reserved; the image catalogue is empty and submission is withheld. |
Keys created from 2026-07-22 onward start with no abilities. Pre-existing keys without a profile keep full legacy access. Input vision does not grant image generation, agent tasks, uploads, TTS or other endpoints.
The owner can also attach project and product metadata to a key (POST /admin/api-keys, PATCH /admin/api-keys/{id}) so spend and errors are attributed per project on the admin Usage & Spending board.
What keys cannot do
- Custom keys can never call
/admin/*. Only the Primary Key and admin browser sessions can. - API keys are refused on
/api/code/*(MaxiMind Code) and on/api/canvas/*(Canvas device login). - All API keys, including legacy admin keys, are denied
{"path": "/absolute/file"}attachments; local paths are only for trusted local requests or logged-in admins. - Custom keys have no worker access unless
worker_profilesis set. - Generate, agent and worker job IDs are private to the key that created them; another key receives 404.
Browser login (Google session)
Signing in with Google in the browser sets a session cookie that is accepted on every surface, from anywhere. It resolves to a real user row with a role:
| Role | Effect |
|---|---|
pending |
New accounts land here. Rejected with HTTP 403 ("awaiting admin approval") until the owner approves them in /admin. |
user |
Approved. Can use the web app at /app/, workspace pages and any grants the owner adds. |
admin |
Approved plus /admin/*. |
Suspended and deleted accounts are refused on every request, and a device or session tied to such an account stops working immediately.
Which credential works where
| Auth | Public API (/api/ai/*, /v1/*, /jobs*, /api/nas/*) |
/admin/* |
/api/code/* |
/api/canvas/* |
|---|---|---|---|---|
| Primary Key | Yes | Yes | No | No |
| Custom key | Yes, within its profile | No | No | No |
| Google session (approved) | Yes | Admins only | Browser approval page only | Browser approval page only |
Code device credential (mmc_…) |
No | No | Yes | No |
| Canvas access token | No | No | No | Yes |
Some /api/ai/* and /api/nas/* routes additionally accept no credentials when the request arrives directly on the owner's trusted local network. That bypass never applies to public traffic: requests through the public edge carry edge headers that force the local-trust check to fail, and /api/ai/worker* always requires a key or approved login even locally.
Three routes have no auth, because the random file name or token is the capability: GET /api/ai/tts/file/{name}, GET /api/ai/image/file/{name} (legacy) and GET /nas/{token}/{filename}. Path traversal is rejected.
Dependency reference
| Dependency | Accepts | Routes |
|---|---|---|
require_api_key |
key, Bearer, session (pending blocked) | /transcribe*, /translate, /perfect-srt, /jobs*, /v1/*, /audio/transcriptions, /history*, /buffer/*, /api/dashboard/*, /api/brands, /api/skills*, /youtube-to-srt, /auth-check |
require_user_or_local |
key, session, trusted local network | /api/ai/* except /api/ai/worker*; /api/nas/* |
require_user |
key, session | /api/ai/worker* |
require_admin |
admin key or admin session | /admin/* |
Other credentials
- MaxiMind Code uses a device credential obtained by browser device login. It is not an API key, is never an admin identity, expires after 90 days and rotates via
maximind whoami. See MaxiMind Code. - Canvas uses approved-account sign-in plus local device pairing with a 30-day refresh token and 60-second access tokens. See Workspace.
- Clients must never place codes, verifiers or tokens in URLs. Responses on these paths are
Cache-Control: private, no-store.