Quickstart

MergeMind Platform is in assisted early access. There is no public self-serve signup or npm install yet — an honest quickstart for where things actually stand today walks through the real onboarding path, not an aspirational one. This is that walkthrough.

1. Request access

Tell us what you're building via developer access. We provision a sandbox tenant and a first user for your team — there's a person on the other end of this, not an automated signup flow, which is also why response is a commitment (24 hours), not instant.

2. Authenticate

Your first user logs in against the gateway. If MFA is enabled for your tenant (recommended, and required for admin-level users), the login call returns MFA_REQUIRED and a transaction id rather than a token — you verify a TOTP code in a second call to get the actual access token.

POST /api/v1/auth/login
{ "email": "you@yourcompany.com", "password": "..." }

→ 200 { "authenticationStatus": "MFA_REQUIRED", "transactionId": "..." }

POST /api/v1/auth/mfa/verify
{ "transactionId": "...", "verificationCode": "123456" }

→ 200 { "accessToken": "<jwt>", "refreshToken": "..." }

3. Make your first authenticated call

Every request after that carries the token as a bearer header. The gateway is the only place it's ever parsed — see Authentication & the request model for what happens next.

curl https://api.mergemind.co/api/v1/tenants/current \
  -H "Authorization: Bearer <jwt>"

→ the gateway validates the token once, signs identity headers
  (X-User-Id, X-Tenant-Id, X-User-Roles, X-User-Permissions),
  and forwards the request to the service that handles it.

4. Where to go next

Tenancy for how isolation works, Authorization for the permission model your roles will use, and Billing if your product needs subscriptions. The Commerce Case Study shows this same request model driving a real, live order end to end.