Skip to main content

​
API Key Authentication

LexQ uses API keys to authenticate all API requests. Include your key in the x-api-key header:

​
Obtaining an API Key

  1. Log in to the LexQ Console
  2. Navigate to Management → API Keys
  3. Click Create API Key
  4. Copy the key immediately — it will not be shown again
API keys follow the format lexq_us_ followed by a Base64 string (e.g., lexq_us_a1b2c3d4e5f6...).

​
Key Management

Revoked keys cannot be reactivated. If a key is compromised, revoke it immediately and create a new one.

​
Security Best Practices

  • Never expose API keys in client-side code, public repositories, or browser requests
  • Use environment variables or secret managers to store keys
  • Rotate keys periodically
  • Use separate keys for development and production environments
  • Each key is scoped to a single tenant — there is no cross-tenant access

​
Scope

Every API key carries a scope, chosen when you create it. The scope decides which APIs the key can reach. Execute only is the default. A key created without an explicit scope cannot reach the Management API, and those calls return 403 with code A-002. Scope is fixed once the key exists. No endpoint changes it, and regenerating a key carries the original scope over. To move between scopes, create a new key with the scope you need and revoke the old one.

​
Rate Limits

API requests are throttled per organization (across all API keys for the same tenant), based on your plan’s Max TPS. Exceeding the limit returns HTTP 429 Too Many Requests with code C-007. See Rate Limits for the per-plan table.