DocsBuild05
API Keys
API keys authenticate machine-to-machine requests. Human users sign in through Elixpo Accounts SSO — keys are only for code that calls Lixrl on your behalf.
Creating a key
Open Profile → API Keys and click Create key. Name it after the app or environment it's for (e.g. blog-prod, ci-pipeline) so you can rotate it later without guesswork.
Format
Keys contain 32 cryptographically random alphanumeric characters with the prefix elu_:
elu_a1b2c3d4e5f67890abcdef1234567890Lost keys cannot be recovered
We hash keys on the server with SHA-256 and only the prefix is kept in the clear. If you lose a key, revoke it and mint a new one.
Sending the key
Authorization: Bearer elu_YOUR_API_KEYAnything else (query strings, cookies, custom headers) is ignored — keys go in Authorization only.
Rotation
- Rotate keys at least every 90 days, or immediately if you suspect a leak.
- Create the new key first, deploy it, verify it works, then revoke the old one.
- Multiple active keys per account are fine — they're cheap to mint and revoke.
Scopes
| Scope | Allows |
|---|---|
| read | List, detail, analytics, and export requests. |
| read,write | Everything in read, plus create, update, disable, and delete links. |
A read-only key is rejected from mutation endpoints.
Limits
Your tier's quota applies per account, not per key. See Pricing for current limits.