REST API and keys
Look up request authentication and the API-key lifecycle.
Call https://api.lepsto.com with a bearer credential. Use the REST API reference to find each operation’s path, inputs, and response.
Requests
Item | Contract |
|---|---|
API host | https://api.lepsto.com |
Authentication | Authorization: Bearer <credential> |
Accepted credentials | A short-lived session token or a long-lived API key starting with lsk_dev_. |
Organization and product routes | /governance/api/v1/… |
Sign-in and API-key routes | /auth/api/v1/… |
Web app requests | Browser session cookies; mutating requests also send X-CSRF-Token. |
Paths depend on the feature area. For example, listing products uses GET /governance/api/v1/products, while an analytics question uses POST /analytics/query. Copy paths from the reference rather than constructing them from a tool name.
Product context by credential
These rules apply to both REST and MCP.
Credential | Product boundary | Effect of X-Product-Id |
|---|---|---|
Static API key ( lsk_…) | Restricted to the product associated with the key. | Naming a different product returns 403, even if the key’s creator belongs to it. |
Exchanged API-key token (Firebase ID token) | Acts as a session of the key owner; the key’s product is the default. | May select another product where the owner is a member. The raw key’s same-product restriction does not carry over. |
Signed-in user token, including OAuth | The token or session supplies the default product. | May select another product only if the caller belongs to it. Without the header, the default remains in effect. |
A user’s access to several products does not extend a static API key’s product boundary.
Read-only request
For a read-only check, set API_KEY to your key, then list the products you can access:
curl https://api.lepsto.com/governance/api/v1/products -H "Authorization: Bearer $API_KEY"Key management
Manage keys on the product’s Developer page in the web app, or use these HTTP routes with an appropriate credential.
Action | Method and path | Result and limit |
|---|---|---|
Create | POST /auth/api/v1/api-keys with productId and name | Requires a signed-in user. An API key cannot create another key; that request returns 403. |
List | GET /auth/api/v1/api-keys?productId=… | Lists active keys with id, name, createdAt, and lastUsedAt; no secret value. |
Revoke | DELETE /auth/api/v1/api-keys/{id} | Returns 204 and ends access. A missing key or one owned by someone else returns 404. |
Exchange | POST /auth/api/v1/api-keys/exchange | Authenticate with an API key to obtain a one-hour Firebase ID token. Other credential kinds return 400. |
Exchange a key for a session token
Authenticate POST /auth/api/v1/api-keys/exchange with the raw API key. The response contains id_token, productId, the key’s scope, and expiresAt. The token lasts one hour and acts as a session of the key owner. Its product_id claim names the key’s product as the default.
The exchanged token has a different product boundary from the raw key. Its holder can use X-Product-Id to select another product where the owner is a member. The raw key’s same-product restriction does not carry over. Neither the product claim nor the returned scope makes the exchanged token restricted to that product.
Create and replace a key
Creation returns id, productId, name, createdAt, lastUsedAt, and plaintext. Copy plaintext when shown: it is returned once. A lost key cannot be recovered.
There is no rotate operation. Create a replacement, update the caller and verify a successful request, then revoke the old key. Both keys remain valid until revocation; do not treat creating the replacement as revoking the original.
API keys and browser sessions have separate lifecycles. Signing out does not revoke a key.