Authentication
All requests to ListenX require an API key issued by TagX.
Sending your key
Pass the key in the X-API-Key header:
curl "$LISTENX_BASE/v1/account/me" -H "X-API-Key: lx_live_xxxxxxxx"
A Bearer token is also accepted:
curl "$LISTENX_BASE/v1/account/me" -H "Authorization: Bearer lx_live_xxxxxxxx"
Key format
Keys look like lx_live_ followed by a random secret. Only a short, non-secret
prefix (e.g. lx_live_a1b2) is stored in plaintext — the full secret is
shown once at creation and stored only as a hash. If you lose it, revoke it
and create a new one.
Errors
| Status | code | Meaning |
|---|---|---|
| 401 | missing_api_key | No key provided |
| 401 | invalid_api_key | Key not found, revoked, or malformed |
| 403 | account_inactive | The account is disabled |
{ "error": { "code": "invalid_api_key", "message": "Invalid or revoked API key." } }
Security tips
- Keep keys server-side; never ship them in web/mobile clients.
- Use a separate key per environment (label them, e.g.
prod,staging). - Rotate keys periodically; revoke immediately if leaked.