Mintlify
DEVELOPER · DEVELOPER
Documentation deployments, previews, static exports, automations, and agent jobs on their own key.
Connecting Mintlify in practice
Mintlify issues three API keys with three prefixes and three blast radii — mint_ for deployments and analytics, mint_dsc_ for assistant and search, mint_us_ for the Index API — and the assistant key spends credits on every message, so leaking that one costs money rather than data. Keys default to a 90-day expiry, and an organization can create at most 10 API keys per hour.
Scopes that draw scrutiny
mint_ (Admin API key)Server-side only. Triggers deployments, runs agent jobs and exports analytics, and is the key that can change published documentation.mint_dsc_ (Assistant API key)Handles assistant messages and documentation search. Every message consumes credits and may trigger overages, so abuse is billed to the owner.mint_us_ (Index API key)Server-side only, authenticating the Index REST API.
Rate limits
- Up to 10 API keys per hour per organization.
Worth knowing
- Keys default to a 90-day expiry — the alternatives are 7, 30, 60, 90 days or no expiry — so an integration left alone stops working roughly a quarter after it shipped.
- Admin and assistant keys can be pinned to IP addresses or CIDR ranges at creation time, which is the only network control, and it cannot be added afterwards.
- Admin keys support a read or write scope restriction; the assistant and index keys do not, so least privilege is only available on one of the three.
- The assistant key can be proxied in production but must not be embedded client-side, because a visitor who extracts it spends the account’s credits.
Checked against Mintlify REST API introduction (2026-09-29), Trigger deployment endpoint (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Mintlify behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.