lovable supabase mindee v2 from mindee v1

Hi Mindee team,

I’m integrating the expense_receipts model via the V2 API from a Supabase Edge Function and I’m consistently receiving 401 Unauthorized.

Endpoint being called

POST https://api.mindee.net/v1/products/mindee/expense_receipts/v5.3/predict Authorization: Token md_******************** Content-Type: image/jpeg Accept: application/json (body: raw JPEG bytes) 

What I’ve verified

• Using a V2 key (prefix md_…), trimmed (no whitespace/newlines).

• Same key tested via curl returns 401 as well.

• Model path uses path segment versioning (/v5.3/), not @v5.3.

• Also tried predict_async; falls back to predict when not supported.

• Content types tried: image/jpeg and image/png.

• No proxy; requests originate from Supabase Edge (Deno) and from local curl.

Recent logs (redacted)

 Mindee base: https://api.mindee.net/v1/products/mindee/expense_receipts/v5.3  Mindee response (sync) 401  Mindee error 401 … 

Questions / help requested

1. Is the expense_receipts v5.3 public model accessible with standard V2 keys, or is a specific entitlement/workspace toggle required?

2. Do V2 keys need to be created inside the same workspace/project where the receipts model is enabled? (Could a key from another workspace cause 401?)

3. Can you confirm the correct product path for the receipts model in V2 (/v1/products/mindee/expense_receipts/v5.3/predict) and that raw binary (not multipart) with Content-Type: image/jpeg is acceptable?

4. Are there any IP restrictions or organization settings that would return 401 instead of 403?

5. If possible, could you check this key’s scope/status on your side (last 24h) to see why auth fails?

Repro with curl

export MINDEE_API_KEY='md_xxxREDACTEDxxx' curl -i -X POST \ -H "Authorization: Token $MINDEE_API_KEY" \ -H "Content-Type: image/jpeg" \ -H "Accept: application/json" \ --data-binary @sample.jpg \ "https://api.mindee.net/v1/products/mindee/expense_receipts/v5.3/predict" 

Thank you! Happy to provide full timestamps, workspace name, and any additional headers privately if that helps you trace the request.