Authentication - Lexful Docs

All Lexful API requests must be authenticated. Requests without valid credentials are rejected. Lexful uses:

An account identifier in the X-Account-ID header.
A short-lived Bearer token in the Authorization header.

Authentication flow

Most integrations follow the same basic steps: obtain a token, then use it on subsequent requests.

Request a Bearer token

Call the auth endpoint with your API key ID and secret:

curl --location 'https://api.us.lexful.app/v1/auth/token' \
  --header 'X-Account-Id: {YOUR_ACCOUNT_ID}' \
  --header 'Content-Type: application/json' \
  --data '{
    "id": "{YOUR_API_KEY_ID}",
    "secret": "{YOUR_API_KEY_SECRET}"
  }'

The response includes a token that is valid for 60 minutes. Treat this as sensitive and do not log or hard-code it.

Call APIs with the token

Include the token and your account ID on API requests:

curl --location 'https://api.us.lexful.app/v1/organizations' \
  --header 'X-Account-ID: {YOUR_ACCOUNT_ID}' \
  --header 'Authorization: Bearer {TOKEN}'

Handle common errors

If a request fails with an authentication-related error, check for:

Missing or incorrect X-Account-ID.
Expired or malformed Bearer token.
Using credentials from the wrong environment.

Inspect the HTTP status code and error body, then verify your headers and credentials.

⌘I

​Authentication flow

Authentication flow