Authentication
Send your LinkinLegal API key in the Authorization header. Key format, scopes, the 20-key limit, revocation and key safety rules.
Every request needs an API key. Send it in the Authorization header as a bearer token.
curl -s "https://api.linkinlegal.com/v1/sanctions/datasets" \
-H "Authorization: Bearer $LINKINLEGAL_API_KEY"There is no other way in. A request without that header, or with a key we do not know, gets 401 with the code invalid_api_key.
Key format
A key starts with lil_sk_, followed by 43 URL-safe characters:
lil_sk_0123456789abcdefghijklmnopqrstuvwxyzABCDEFGThe key is shown once
The full key is shown one time, when you create it. We store a hash only, so we cannot show it or mail it to you later. Copy it into your secret store at once. If you lose it, revoke the key and create a new one.
Create and revoke keys
Keys live in the developer console at /developer/keys.
- You can hold up to 20 active keys per account. Revoke one before you create number 21.
- You choose the expiry when you create the key: 1 hour, 1 day, 7 days, 30 days, 90 days, 180 days, 1 year, or never. An expired key gets
401invalid_api_key. The expiry cannot be changed later: create a new key. - Revoke a key in the console. The key stops working at once, and every later call with it gets
401invalid_api_key. - Use one key per system (for example: one for your onboarding service, one for your nightly job). Then a leak costs you one key, not all of them.
Scopes
A key carries scopes. Every sanctions endpoint needs the scope sanctions:read. A key without it gets 403 with the code missing_scope.
A key also needs an active plan for the API it calls. Read Plans and billing.
Keep the key safe
- Use the key from your server only. Never put it in a browser page, a mobile app, a desktop app or a public repository. Anything you ship to a user can be read by that user.
- Read the key from an environment variable or a secret store, not from the source code.
- Call our API from your backend, and let your frontend call your backend.
- If a key leaks, rotate it: create a new key, deploy it, then revoke the old one. In that order, so nothing stops.
Request ids
Every response carries the header X-Request-Id:
X-Request-Id: 8801e73e-13b4-41f7-94e3-1a6eccfd0bdcEvery error body repeats the same value in error.request_id.
Log this value with your own request log. When you report a problem, send it to us. With it we find your exact request; without it we cannot.