Authentication

The public SDK accepts partnerId and apiKey. It sends the key using X-API-Key and scopes Partner resources to the configured Partner. It does not expose the internal SDK’s bearer-token or token-provider helpers.

Keep API keys in server-side secrets. Never place them in browser bundles, mobile apps, public environment variables, logs, or prompts sent to AI tools. Grant each key only the capabilities its integration needs.

Handle errors

import { MinmoClient, MinmoSdkError } from "@minmoto/sdk";

const minmo = new MinmoClient({
  partnerId: process.env.MINMO_PARTNER_ID!,
  apiKey: process.env.MINMO_API_KEY!,
});

try {
  await minmo.account.get();
} catch (error) {
  if (error instanceof MinmoSdkError) {
    console.error({
      code: error.code,
      status: error.status,
      requestId: error.requestId,
      retryable: error.retryable,
    });
  }
  throw error;
}

Use retryable as an input to a bounded retry policy. Preserve idempotency keys when retrying operations that create payable resources or move money. Do not blindly retry an operation whose outcome is unknown; reconcile its state.