Get started

Authentication

Send your API key on every request, either as a Bearer token or in an X-API-Key header. The key decides which workspace wallet pays.

Keys start with lsk_. Use whichever header suits your client:

http

Authorization: Bearer lsk_your_api_key
# or
X-API-Key: lsk_your_api_key

What a key controls

Property	Behaviour
Workspace	A key belongs to one workspace. Searches it submits are charged to that workspace’s search wallet.
Owner	A key is tied to the workspace it was created in. It stops working when the person who holds it leaves the workspace.
Embed keys	A key made for embedding can read results but cannot spend credits. Use a server key to submit searches.
Revocation	A deactivated key is refused immediately with 401.
Rate limits	Per key. See Errors for the 429 response and Retry-After.
Domain-restricted keys	If the key has an allowed-domain list, requests must carry an Origin or Referer header from that domain. Use a key with no restriction for server-to-server calls.

You get 401 and an error body:

json

{
  "error": {
    "code": "unauthorized",
    "message": "API key not found"
  }
}

message	Meaning
`Invalid API key format`	The value does not look like an lsk_ key.
`API key not found`	No such key. Check for a stray space or a revoked key.
`API key is deactivated`	The key was switched off in the workspace.
`Domain not allowed`	The Origin does not match the key’s allowed domains.
`Origin header required for domain-restricted keys`	Add the header, or use an unrestricted key from your server.

Keep keys on your server

Never ship an lsk_ key in a browser or mobile app. Anyone holding it can spend your credits.

Need a key? See Get an API key. The only unauthenticated endpoint is the public catalog.