Authorization header on every request.
lx_<key_id>_<secret>. Create and revoke them in the dashboard. A key is shown once when you create it, so store it in an environment variable or a secrets manager. Never put a key in browser code or a public repository.
If a key leaks, revoke it in the dashboard and create a new one.
Scopes
Each key is limited to the scopes you choose. A request that needs a scope the key lacks returns403 with the code auth.scope_missing. Each endpoint page lists the scope it needs.
Give a key only the scopes it needs. An integration that only reads call results needs
calls:read and nothing else.
Roles
Some operations also need a minimum role for the person who owns the key. For example, creating a webhook endpoint needs an admin. A request that fails the role check returns403 with the code auth.forbidden.