lovable supabase mindee v2 from mindee v1

Bug ReportSep 23, 2025

Hi Mindee team,

I’m integrating the expense_receipts model via the V2 API from a Supabase Edge Function and I’m consistently receiving 401 Unauthorized.

Endpoint being called

POST https://api.mindee.net/v1/products/mindee/expense_receipts/v5.3/predict Authorization: Token md_******************** Content-Type: image/jpeg Accept: application/json (body: raw JPEG bytes)

What I’ve verified

Using a V2 key (prefix md_…), trimmed (no whitespace/newlines).
Same key tested via curl returns 401 as well.
Model path uses path segment versioning (/v5.3/), not @v5.3.
Also tried predict_async; falls back to predict when not supported.
Content types tried: image/jpeg and image/png.
No proxy; requests originate from Supabase Edge (Deno) and from local curl.

Recent logs (redacted)

 Mindee base: https://api.mindee.net/v1/products/mindee/expense_receipts/v5.3  Mindee response (sync) 401  Mindee error 401 …

Questions / help requested

Is the expense_receipts v5.3 public model accessible with standard V2 keys, or is a specific entitlement/workspace toggle required?
Do V2 keys need to be created inside the same workspace/project where the receipts model is enabled? (Could a key from another workspace cause 401?)
Can you confirm the correct product path for the receipts model in V2 (/v1/products/mindee/expense_receipts/v5.3/predict) and that raw binary (not multipart) with Content-Type: image/jpeg is acceptable?
Are there any IP restrictions or organization settings that would return 401 instead of 403?
If possible, could you check this key’s scope/status on your side (last 24h) to see why auth fails?

Repro with curl

export MINDEE_API_KEY='md_xxxREDACTEDxxx' curl -i -X POST \ -H "Authorization: Token $MINDEE_API_KEY" \ -H "Content-Type: image/jpeg" \ -H "Accept: application/json" \ --data-binary @sample.jpg \ "https://api.mindee.net/v1/products/mindee/expense_receipts/v5.3/predict"

Thank you! Happy to provide full timestamps, workspace name, and any additional headers privately if that helps you trace the request.

Posted by chanua4 johnson · Sep 23, 2025

Completed7

chanua4 johnson

•

Oct 1, 2025

i tried this am again. see console log below, how am I calling the Mindee API? : How the call is made (step-by-step)

Source of the call (client): src/utils/receipt/ocrProcessing.ts
- In demo mode (your logs show blob: URLs), we:
  - Read the blob and convert it to base64
  - Call the Supabase Edge Function with supabase.functions.invoke('process-receipt', { body })
Edge Function: supabase/functions/process-receipt/index.ts
- Reads env secrets: MINDEE_API_KEY (md_…) and MINDEE_MODEL_ID (UUID)
- Decodes the base64 into a Blob
- Calls mindeeClient(apiKey, blob)
Actual HTTP requests to Mindee (server-side): supabase/functions/process-receipt/mindee.ts
- Enqueue (v2): POST https://api-v2.mindee.net/v2/inferences/enqueue
  - Headers:
    - Authorization: md_… (no Bearer)
    - Accept: application/json
  - Body: multipart/form-data
    - model_id: <your v2 model UUID>
    - file: File([blob], "receipt.jpg", { type: "image/jpeg" })
- Poll job: GET https://api-v2.mindee.net/v2/jobs/{job_id}
  - Headers: Authorization: md_…, Accept: application/json, redirect: manual
  - Repeats until Mindee returns 302 with a Location header
- Fetch result: GET <Location URL from the 302> with Authorization: md_…
- Normalize the result into the shape your UI expects (amount, date, supplier, lineItems, confidence)

What the logs say right now

Edge logs for process-receipt show:
- 🔧 Using v2 model_id: 63f56d0d-73b2-4239-91a3-9b4cd14cd1d3
- 📥 Mindee enqueue raw response: {"status":402,"detail":"No active subscription."}
- ❌ Mindee enqueue failed: 402 { status: 402, detail: "No active subscription." }
So the endpoint, headers, and payload are all v2-correct. The failure is Mindee returning 402 Payment Required with “No active subscription. console log: 3851-612cfa8921ee1db9.js:1 Initializing RudderStack Analytics

VM20182:2

⠀⠀#######

##########

#############

##############

###################

#####################

#######################

######################

###################

We're hiring!https://lovable.dev/careers

ff2c0863-6570a9614b6871f5.js:1 Unrecognized feature: 'vr'.

e4 @ ff2c0863-6570a9614b6871f5.js:1

sc @ ff2c0863-6570a9614b6871f5.js:1

sd @ ff2c0863-6570a9614b6871f5.js:1

(anonymous) @ ff2c0863-6570a9614b6871f5.js:1

ix @ ff2c0863-6570a9614b6871f5.js:1

ik @ ff2c0863-6570a9614b6871f5.js:1

(anonymous) @ ff2c0863-6570a9614b6871f5.js:1

iu @ ff2c0863-6570a9614b6871f5.js:1

iX @ ff2c0863-6570a9614b6871f5.js:1

A @ 1689-6933b1316fa878df.js:11

ff2c0863-6570a9614b6871f5.js:1 Unrecognized feature: 'ambient-light-sensor'.

e4 @ ff2c0863-6570a9614b6871f5.js:1

sc @ ff2c0863-6570a9614b6871f5.js:1

sd @ ff2c0863-6570a9614b6871f5.js:1

(anonymous) @ ff2c0863-6570a9614b6871f5.js:1

ix @ ff2c0863-6570a9614b6871f5.js:1

ik @ ff2c0863-6570a9614b6871f5.js:1

(anonymous) @ ff2c0863-6570a9614b6871f5.js:1

iu @ ff2c0863-6570a9614b6871f5.js:1

iX @ ff2c0863-6570a9614b6871f5.js:1

A @ 1689-6933b1316fa878df.js:11

ff2c0863-6570a9614b6871f5.js:1 Unrecognized feature: 'battery'.

e4 @ ff2c0863-6570a9614b6871f5.js:1

sc @ ff2c0863-6570a9614b6871f5.js:1

sd @ ff2c0863-6570a9614b6871f5.js:1

(anonymous) @ ff2c0863-6570a9614b6871f5.js:1

ix @ ff2c0863-6570a9614b6871f5.js:1

ik @ ff2c0863-6570a9614b6871f5.js:1

(anonymous) @ ff2c0863-6570a9614b6871f5.js:1

iu @ ff2c0863-6570a9614b6871f5.js:1

iX @ ff2c0863-6570a9614b6871f5.js:1

A @ 1689-6933b1316fa878df.js:11

ff2c0863-6570a9614b6871f5.js:1 An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.

un @ ff2c0863-6570a9614b6871f5.js:1

ub @ ff2c0863-6570a9614b6871f5.js:1