Introduction

Every endpoint lives under https://api.mynth.io. It speaks JSON, except POST /image/upload, which takes multipart form data. It authenticates with a bearer token. No SDK is required.

The endpoint pages are generated from the API's OpenAPI document, so every parameter they list is one the API validates. The document itself is at api.mynth.io/openapi.json.

curl https://api.mynth.io/image/generate \
  -H "Authorization: Bearer $MYNTH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"black-forest-labs/flux.2-pro","prompt":"A lighthouse at dusk"}'

Conventions

• Generation is asynchronous. A generate call returns a task, not media. Poll the task or receive a webhook. The task object covers every field.
• Successful bodies are wrapped in data, errors in error. An error is { "error": { "code", "message" } }, with a lowercase snake_case code. See errors.
• Field names are snake_case, in requests, responses, and webhook events.
• Money is a decimal string in USD, such as "0.03". Parse it with a decimal type, not a float.
• Ids have prefixes: tsk_ tasks, img_ images, vid_ videos, ak_ API keys, wbh_ webhooks, dst_ destinations.
• Unknown request fields are rejected with 400 validation_error, which names each one, so a typo never runs as a silently ignored setting.
• There are no idempotency keys. Every create is a new task and a new hold. See what is safe to retry.

Credentials

curl https://api.mynth.io/tasks \
  -H "Authorization: Bearer $MYNTH_API_KEY"

An API key belongs on a server. A public access token comes with a task that asked for one with generate_public_access_token: true, expires after an hour, and can only read that task's status and result, which is why it is safe in browser code. Authentication has the rules for both, and the scope each endpoint needs.

Endpoints