API key rules
Create API keys in the portal and store them in backend secrets. The raw key is shown once. After that, the portal only exposes masked metadata.
- Use the
Authorization: Bearer ...header on runtime requests. - Do not expose Licenzy keys to the browser.
- Test and live keys are separate and select the runtime mode automatically.
Mode comes from the API key
Runtime requests do not carry mode in the request body. Licenzy infers the environment from the API key you send.
Runtime auth headersConcrete integration example
HTTPAuthorization: Bearer lz_test_...
Content-Type: application/jsonWrong key, wrong environment
If you send a live key while expecting test behavior, Licenzy will operate in live mode. The key determines the environment boundary.