Authentication

All Lizen API requests require a bearer token in the Authorization header.

Authorization: Bearer lz_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

API key format

API keys start with lz_ followed by 32 random alphanumeric characters. They are generated in the dashboard under Settings → API Keys and shown exactly once at creation. Store them securely — they cannot be retrieved after creation, only rotated.

lz_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p

Scopes

Each API key has a permission scope:

Scope	What it can do
full_access	All endpoints
validate	POST /v1/validate only
keys:read	List and view keys
keys:write	Create and extend keys
keys:revoke	Revoke keys
products:read	List and view products
products:write	Create, update, delete products
analytics:read	Access analytics endpoints
offline:write	Generate and sync offline licenses

Use the narrowest scope that meets your needs. For embedded use (inside your app binary), use validate only.

Security rules

• Never include your API key in your app binary. Use environment variables.
• Rotate keys from Settings → API Keys if you suspect compromise.
• Use validate-scoped keys for your app; full_access only for server-side automation.
• Revoked keys are blocked globally in under 1 second.

Example

curl https://api.lizen.dev/v1/ping \
  -H "Authorization: Bearer lz_your_key_here"

{ "status": "ok", "accountId": "acc_xyz" }