Authentication

Every call carries an API key of your account in the X-Api-Key header. The key decides which account is used and billed; there is nothing else to send.

curl -G "https://api.locapi.eu/v1/usage" \
  -H "X-Api-Key: $LOCAPI_API_KEY"

Keys#

Keys start with lk_live_. You create and revoke them in the dashboard.
A new key is shown once. We store only its prefix and a secure hash, so we cannot show it again or recover it. Lost it? Create a new one and revoke the old one.
A revoked key is refused on the very next request. There is no cache that keeps it alive.
Use a separate key per system or environment, so you can revoke one without touching the others.

Server-side only#

Call LocAPI from your own server and pass the result to your front end. A key in browser or app code can be read by anyone and used on your bill; the API does not allow calls from browsers (there is no CORS).

When authentication fails#

A missing, malformed, unknown or revoked key gets the same answer, so a key cannot be probed. A valid key of a blocked account gets 403 account_blocked.

Response · 401

{
  "type": "https://locapi.eu/problems/invalid-api-key",
  "title": "Invalid API key",
  "status": 401,
  "code": "invalid_api_key",
  "detail": "The X-Api-Key header is missing, unknown or revoked.",
  "requestId": "req_0192b0c4-…"
}