Skip to main content
Every /v1/* endpoint requires a server API key (prefix mir_srv_). Keys are scoped to a single project — a request only ever sees data from the project its key belongs to.

​
Server keys vs. SDK keys

Mirador uses different keys for different surfaces. Use the right one:
Web keys are rejected by the REST API. If you get a 401 with UNAUTHENTICATED, confirm you’re using a mir_srv_* server key and not an SDK/ingest or web key.

​
Creating a server key

Create a server key in the Mirador dashboard under your project’s API keys. Treat it like a password: it grants read access to every trace in that project.

​
Sending the key

Pass the key on every request using either header:
Verify a key resolves correctly before doing real work:

​
Public endpoints

The documentation endpoints do not require a key:
  • GET /docs — Swagger UI
  • GET /openapi.yaml, GET /openapi.json — the OpenAPI contract
  • GET /llms.txt — the agent-facing brief
  • GET /health — liveness check

​
Keeping keys safe

  • Store keys in environment variables or a secrets manager — never in source control.
  • Use a separate key per integration so you can rotate or revoke one without affecting others.
  • Scope keys to the project they need; a key cannot read across projects.
  • Rotate keys periodically and on staff changes.

​
Next Steps

Endpoints

Every endpoint, filter, and response shape

Exporting traces

Pull a full trace + events into another system