Authentication & API Keys
Bearer token authentication, the organisation key pool, and key creation and rotation rules for the Lagrange API.
Every API call uses Bearer Token authentication. Keys belong to an organisation (org) and members share the organisation's key pool.
Request headers
Authorization: Bearer lgr_live_xxxxxxxx
X-Org-Id: <optional, platform keys only>Key model
| Property | Description |
|---|---|
key_prefix | Only the first 12 characters are stored, for display and lookup; the full key is visible only at creation |
scopes | Comma-separated capability domains: search read watch compute draft |
expires_at | Optional ISO 8601 date; the key expires automatically |
rpm / daily_cap | Requests per minute / credits per day |
Creating and managing keys
Keys are created, revoked and monitored in the console (API Keys page). Management operations are deliberately not exposed through the public API — the lifecycle of a key must go through a human-auditable panel.
Rate limits and errors
| Status | Meaning | What to do |
|---|---|---|
401 | Invalid or revoked key | Check the key status in the console |
403 | Insufficient scope | This key was not granted the required capability domain |
429 | RPM / daily_cap exceeded | The response carries Retry-After; wait that many seconds |
Security conventions
A key is an identity. Never put it in frontend code, a Git repository or logs. If it leaks, revoke it immediately in the console and create a new one — revocation takes effect instantly.