Authenticate API requests

Authenticate REST API and SDK requests with an API key. An owner or admin can create, change or revoke keys in Settings. That article covers key management and what happens when a key’s creator leaves.

Send the key

Pass the key in the Authorization header as a Bearer token:

curl "https://api.lightfield.app/v1/accounts?limit=1" \
  -H "Authorization: Bearer $LIGHTFIELD_API_KEY" \
  -H "Lightfield-Version: 2026-03-01"

Set LIGHTFIELD_API_KEY in your process environment or secret store. Keep it out of browser code, repositories and logs. For SDK configuration, use the quickstart for your language under API guides.

Validate the key before making scoped requests

Validate the current API key without requiring a resource scope:

curl https://api.lightfield.app/v1/auth/validate \
  -H "Authorization: Bearer $LIGHTFIELD_API_KEY" \
  -H "Lightfield-Version: 2026-03-01"

A successful response has active: true, tokenType: "api_key", the subjectType (user or workspace) and scopes. An empty scope list means full access, not no access. This validates the credential; record visibility and write permissions still apply to later calls. A revoked or invalid credential returns an authentication error instead of active: false.

Choose permissions

Give each integration its own key with only the scopes it needs. Listing accounts requires accounts:read; writes need the corresponding create, update or other operation scope. Check each endpoint’s requirements in the API reference.

Check authentication failures

• 401: check that the key is set, valid and sent as Authorization: Bearer ....
• 403: check the required scope and the access available to the key’s creator.

See Errors for response handling and API key troubleshooting for invalidated or revoked keys. For an exposed key, follow Leaked API key remediation.

MCP authentication

MCP clients use an interactive OAuth connection instead of this API key header. Start with the MCP quickstart.