Authentication

Every request to /v1/* and /mcp carries an API key. There is no anonymous access and no session cookie on the API.

Header

Authorization: Bearer lf_live_…        # preferred
X-API-Key: lf_live_…                   # also accepted

Keys

Created and revoked on Account → API keys; shown once, stored hashed. Up to 10 active keys per account, labelled (production, staging, claude-desktop…).
Prefix lf_live_ on production, lf_test_ on staging. Keys never expire on their own; rotate by creating a new key and revoking the old.
Keys are per company. Do not put them in browser code, public repos or shared prompts. If one leaks, revoke it; usage under a key is your usage.
All keys on an account share the account's plan, quota and rate limit.

Responses

`401 unauthorized`	Header missing, malformed, unknown or revoked key.
`403 plan_required`	The key is valid but the feature (contacts, retired rows) needs pay-as-you-go.
`429 rate_limited`	Too many requests per minute for the plan. Back off; `Retry-After` is set.
`429 quota_exceeded`	Monthly records used up and no overage on the plan.

Transport

HTTPS only; HTTP is redirected and HSTS is set. TLS 1.2+. The API sends Cache-Control: no-store; responses containing contacts must not be cached by shared proxies.