Start · Authentication

# Authentication

Every API request carries a key in the `Authorization` header. Keys are created in the console and belong to the account, so anyone in it can use or revoke them.

## The header

```
Authorization: Basic lbkm_V8nq3TzK0wLc5mHr7yXa2dPe9sGu4bJf6iNo1tQw
```

When you create a key, the console shows the full header value once, starting with “Basic ”. Copy it then: we keep only a hash of the key and can’t show it again. If you lose it, revoke it and create another.

A key is “lbkm_” followed by 40 letters and digits.

## What follows “Basic ”

Send the key as the console shows it. Clients that build HTTP Basic credentials themselves also work:

Accepted forms of the header value

- **The key itself**: `Basic lbkm_…`
- **Base64 of the key**: `Basic bGJrbV8…`
- **Base64 of user:password**: With the key as either half, which is what `curl -u "$MEDIA_KEY:"` and most HTTP libraries send.

The word “Basic” may be in any case.

## Check a key

```bash
curl https://media.logicboostkit.com/directory \
  -H "Authorization: Basic $MEDIA_KEY"
```

```json
{ "ok": true, "directories": [] }
```

## Keys

- A key has a name and, if you set one, an expiry date. Usage is counted per key, so one key per app or environment keeps the numbers apart.
- Any key of the account can call any endpoint, the usage export included.
- A revoked or expired key stops working within 60 seconds.
- Each key may send 300 requests a minute. See [Limits](https://media.logicboostkit.com/docs/limits).

## Status codes

Status codes

- **401**: `Authorization Header Required`: the request has no `Authorization` header.
- **401**: `Invalid API key`: the key is wrong, malformed, revoked or expired, or its account was closed.
- **403**: The key is valid but its account isn’t active. The error says what to do:
`Add a card at media.logicboostkit.com/console to start using the API.`
`A payment failed. Pay the open invoice at media.logicboostkit.com/console to resume.`
`This account is suspended. Contact contact [at] logicboostkit [dot] com.`
- **429**: The key sent more than 300 requests in a minute. Wait for the number of seconds in `Retry-After`.