Source: https://legiscore.in/docs/authentication

# Authentication

Send your API key on every request, as a Bearer token or in an X-API-Key header. The key decides which workspace wallet pays.

```http
Authorization: Bearer lsk_your_api_key
# or
X-API-Key: lsk_your_api_key
```

| Property | Behaviour |
| --- | --- |
| Workspace | A key belongs to one workspace. Searches it submits are charged to that workspace's search wallet. |
| Revocation | A deactivated key is refused immediately with 401. |
| Rate limits | Per key. See Errors. |
| Domain-restricted keys | Requests must carry an Origin or Referer header from an allowed domain. Use an unrestricted key for server-to-server calls. |

401 body: `{ "error": { "code": "unauthorized", "message": "API key not found" } }`. Messages: Invalid API key format, API key not found, API key is deactivated, Domain not allowed, Origin header required for domain-restricted keys.

Keep keys on your server. Never ship an lsk_ key in a browser or mobile app. The only unauthenticated endpoint is the public [catalog](https://legiscore.in/docs/api/catalog). Get a key: https://legiscore.in/docs/get-an-api-key