Authenticating requests with API keys

Every request to the API is authenticated with a secret key sent as a bearer token in the Authorization header. There are no sessions or cookies — each request stands alone.

Sending the key

Authorization: Bearer ls_live_your_key_here

Live keys are prefixed with ls_live_ and sandbox keys with ls_test_. Sandbox keys hit the same endpoints but return synthetic data and never bill against your plan.

Storing keys safely

• Keep secrets in environment variables or a secrets manager, never in source control.
• Use server-side code only — a key in front-end JavaScript is a public key.
• Scope keys per environment so a leaked staging key cannot touch production data.

Rotating without downtime

Create the new key first, deploy it to your services, confirm traffic is flowing on the new key, then revoke the old one. Because keys are independent, both work simultaneously during the overlap, so there is no window where requests fail.