Mobile apps: app tokens
A company user signs in with their email and password and gets a token for the app API and the app MCP server. Two-step verification and password rules apply as in the app.
POST /api/v1/app/token
Mihnaro for developers
Your HR data, in your own systems
A REST API for mobile apps and integrations, and MCP servers for AI assistants. Both use the same accounts, permissions and rules as the app, in English and Arabic.
REST API
https://api.mihnaro.com/api/v1
MCP · app
https://api.mihnaro.com/mcp/app
MCP · platform
https://api.mihnaro.com/mcp/platform
Guides
Getting started
Your first call in five minutes: a key or token, the headers and copy-ready examples.
API concepts
Permissions and branches, pages, dates, errors, limits and versions.
Reference by section
The main endpoints of each section, and Postman.
Webhooks
Events, payloads and signature checks in PHP, JavaScript and Python.
AI assistants (MCP)
Connect Claude Desktop, Claude Code or another MCP client.
Signing in
Integrations: company API keys
Company admins create keys under Settings, Integrations. A key starts with mhk_, works only on its own company, acts as the person it was made for, and can be limited to reading, writing, updating or deleting, to IP addresses and to an end date.
Authorization: Bearer mhk_…
Mihnaro staff: platform keys
The platform API and MCP server manage companies, licenses and the website. Only Mihnaro platform admins get these keys.
/api/v1/platform · /mcp/platform
Rules every call follows
- Permissions. Every call checks the company's license, then the person's role, then the scope it was given in, exactly as the app does.
- Rate limits. 60 requests a minute for the app API, 120 for the platform API and 10 for sign-in and password calls. Past the limit the answer is 429 with Retry-After.
- Languages. Send Accept-Language: ar for Arabic messages; English is the default.
- Errors. Always JSON, with a message and, where useful, a code such as password_change_required.
- Webhooks. Companies can also receive their events, signed with HMAC-SHA256, at their own addresses.
A first call
curl -X POST https://api.mihnaro.com/api/v1/app/token \
-H "Accept: application/json" \
-d [email protected] -d password=… \
-d device_name="My app"
curl https://api.mihnaro.com/api/v1/app/me \
-H "Authorization: Bearer <token>" \
-H "Accept-Language: ar"The reference lists every endpoint with the permission it needs, and every MCP tool. reference.json · openapi.json
Want to see the data first?
Try the live demo, or read the help center.