Your site or app

Add a “Verify with mezein” button. People confirm on mezein with their pin, and you get back a yes and an ID for them.

1. Get a key

Go to app.mezein.com/platform → Request an API key. Give your site's name (people see it when they verify), a contact email, and your redirect address: the page on your site mezein sends people back to. You get:

• An API key (mz_live_…), shown once. Keep it in your server's settings, never in code or the browser.
• Your partner ID.
• A prompt for your coding agent (Claude Code, Cursor and so on), with your details filled in. Paste it in and it builds everything below.

2. Send people to mezein

On click, your server makes a random state, keeps it in the user's session, and redirects to:

https://app.mezein.com/connect?partner=<partner id>&redirect_uri=<your redirect address, URL-encoded>&state=<state>

The redirect address must match one you registered exactly. They see your site's name and confirm with their pin. If they don't have one yet, the page tells them how to get one.

3. Swap the code for their ID

mezein sends them back to your redirect address with ?code=…&state=…, or ?error=access_denied if they declined. Check the state matches, then from your server:

POST https://app.mezein.com/api/v1/token
Authorization: Bearer $MEZEIN_API_KEY
Content-Type: application/json

{ "code": "<code>", "redirect_uri": "<the same redirect address>" }

200 → { "name": "<26-character mezein ID>", "person": true, "new": false }

Codes work once, for 5 minutes. Save name on the user's account, and only treat them as verified if person is true.

4. Check again later

GET https://app.mezein.com/api/v1/check?name=<mezein ID>
Authorization: Bearer $MEZEIN_API_KEY

200 → { "name": "…", "person": true, "new": false }

Check before anything sensitive, or once a day. If person turns false, their pin has been paused or removed: take away their verified status.

5. Report fake or abusive accounts

POST https://app.mezein.com/api/v1/reports
Authorization: Bearer $MEZEIN_API_KEY
Content-Type: application/json

{ "name": "<mezein ID>", "kind": "bot", "note": "optional, up to 1,000 characters" }

201 → { "id": "…" }

Kinds: bot, sold_pin, duplicate, abuse, text_flag, other. You can also report from your dashboard. See Reporting.

Errors

Errors are JSON: { "error": "<code>", "message": "<sometimes>" }.

Good practice

Keys

• Call mezein only from your server. The key never goes in the browser, an app bundle, a repository or logs.
• Keep it in your host's secret settings (for example MEZEIN_API_KEY).
• If a key leaks, email first@mezein.com straight away and we'll replace it.

The flow

• Always check state, so nobody can link their pin to someone else's account.
• Handle error=access_denied and a failed code swap with a friendly message and a way to try again.
• Swap the code straight away; it expires after 5 minutes.

Your data

• Store only the mezein ID. Never ask people for personal details “for mezein”.
• Decide what you do if one mezein ID is already linked to another account. It's the same person: one account each is the usual rule.
• Use new for extra care on things that are easy to abuse (payouts, bulk invites, giveaways), rather than shutting new people out.

Testing

• Register http://localhost:<port>/… as a second redirect address when you request your key, and test against the live service with your own pin.
• Write tests for: a state mismatch is rejected, access_denied is handled, a failed code swap shows a message, and person: false removes verified status.
• Your test checks show in your dashboard's numbers like any others.