Authentication

Every request carries your key as a bearer token:

curl https://resources.ashwanth.dev/api/v1/dashboard \
  -H "Authorization: Bearer lmb_live_YOUR_KEY"

Creating a key

Go to Settings, then Developers, then Create API key. Give it a name you will recognise later, pick the scopes it needs, and choose an expiry.

You see the key exactly once. We store only a SHA-256 hash of it, so it cannot be shown again, by you or by us. This is not a UI convention we could relax: the plaintext genuinely is not in the database. If you lose a key, revoke it and create another.

Store it the way you would any secret. An environment variable is the usual answer:

export LEADMAGNET_API_KEY="lmb_live_..."

curl https://resources.ashwanth.dev/api/v1/me \
  -H "Authorization: Bearer $LEADMAGNET_API_KEY"

Scopes

A key carries only the scopes you grant it. Read scopes are selected by default, and each write capability is a separate scope, so a key issued today can never gain a power added tomorrow.

If a key is missing what a call needs, you get 403 insufficient_scope naming the exact scope required. That is deliberately not a 401, because a 401 would tell you to rotate a key that is perfectly fine.

Expiry and revocation

A key can expire after 30, 60, 90, or 365 days, or never. Expiry is checked on every request, so an expired key stops working the moment it lapses.

Revoking is immediate and takes effect on the very next request. Revoked keys are kept rather than deleted, so you keep the record of what existed and when it was last used.

Key format

Keys look like lmb_live_ followed by 43 url-safe characters. The lmb_ prefix is there so a leaked key is greppable in a repository and recognisable in a log.

Treat a key as equivalent to your password for reading this account. Anyone holding it can read everything its scopes allow.