Skip to main content
public preview

This is a proposed contract. No concrete public host or key-issuer URL is published. Every command and response is illustrative.

Authentication preview

Review the proposed API-key contract.

Overview

The proposed contract uses API key authentication. Illustrative requests place a token in the Authorization header. No concrete public key-issuer URL is published.

Important: Keep API keys secret. Never ship them in client-side code. Never commit them to public repositories.

Proposed key issuance

The docs publish no concrete dashboard URL. The proposed issuer flow is:

  1. Log in to a future Legba organization dashboard
  2. Navigate to Settings → API Keys
  3. Click Generate New API Key
  4. Copy and securely store your API key

Proposed secret handling

The proposed issuer would show a key once. Production behavior remains unpublished.

Proposed authenticated request

The illustrative examples place a placeholder token in the Authorization header using the Bearer scheme:

curl -X GET "https://{your-api-host}/orgs/{org_uuid}/api/instances" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json"

Proposed authentication errors

The proposed contract models authentication failure as a 401 Unauthorized response:

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or missing API key"
  }
}

Proposed failure modes

Missing Authorization Header

The proposed contract requires the Authorization header on each protected request.

Incorrect Format

The illustrative header uses this format: Bearer YOUR_API_TOKEN

Expired or revoked key

An eventual issuer should define expiry, revocation, and replacement behavior before launch.

Security controls for implementation

Store Keys Securely

Use environment variables or secret management services to store API keys. Never hardcode them in your source code.

Define key rotation

A production issuer should support replacement and revocation without downtime. Review the proposed API Keys contract.

Use HTTPS Only

Always make API requests over HTTPS to ensure your API key is encrypted in transit.

Limit Key Scope

If your organization supports scoped keys, create keys with the minimum necessary permissions for your use case.

Plan usage monitoring

A production service should expose reviewable audit logs for authentication and lifecycle events.

Continue the preview

No callable public endpoint or key-issuer URL is published. Continue reviewing the proposed contract: