Authentication

The Licentric API supports three authentication methods depending on the operation.

API Key Authentication

Used for management operations: creating and managing licenses, products, policies, entitlements, webhooks, and viewing analytics. Pass your API key as a Bearer token in the Authorization header.

Header

Authorization: Bearer lk_live_a1b2c3d4e5f6g7h8i9j0...

Key Prefixes

Live keys use the lk_live_ prefix. Test keys use lk_test_ and operate in an isolated sandbox environment.

License Key Authentication

Used for license-scoped operations: machine activation, deactivation, and heartbeats. Pass the license key with the License scheme.

Header

Authorization: License DSK-A1B2-C3D4-E5F6-G7H8

No Authentication

The POST /licenses/validate-key endpoint requires no authentication header. The license key is sent in the request body instead. This allows client-side validation without exposing API keys.

Example

curl -X POST https://your-instance.licentric.com/api/v1/licenses/validate-key \
  -H "Content-Type: application/json" \
  -d '{ "key": "DSK-A1B2-C3D4-E5F6-G7H8" }'

API Key Scopes

API keys can be scoped to limit their permissions. If no scopes are specified, the key has full access. Requests with insufficient scopes receive a 403 Forbidden response.

Available Scopes

Parameter	Type	Required	Description
licenses:read	scope	Optional	List and retrieve licenses
licenses:write	scope	Optional	Create, update, suspend, reinstate, renew, and delete licenses
machines:read	scope	Optional	List and retrieve machines
machines:write	scope	Optional	Activate and deactivate machines (via API key)
products:read	scope	Optional	List and retrieve products
products:write	scope	Optional	Create and update products
policies:read	scope	Optional	List and retrieve policies
policies:write	scope	Optional	Create and update policies
entitlements:read	scope	Optional	List and retrieve entitlements
entitlements:write	scope	Optional	Create and update entitlements
webhooks:read	scope	Optional	List webhook endpoints
webhooks:write	scope	Optional	Register and manage webhook endpoints
analytics:read	scope	Optional	Access dashboard analytics data

Security

Never expose API keys in client-side code. Use license key authentication or the public validate-key endpoint for client applications.

Overview Errors