Get started
Authentication
How to authenticate LynCut API requests.
API keys
Server-to-server requests authenticate with the x-lyncut-api-key header. Create and revoke keys from the dashboard under Settings → API keys.
curl "https://api.lyncut.com/v1/profile" \
-H "x-lyncut-api-key: YOUR_API_KEY"Treat keys like passwords. Rotate any key that may have leaked, and scope each key to the minimum providers you need.
Session cookies (first-party apps)
The LynCut web and desktop apps authenticate with an HTTP-only session cookie issued by /auth/session after OAuth sign-in. Cookie sessions are for first-party clients only — third-party integrations must use API keys.
| Credential | Header | Use case |
|---|---|---|
| API key | x-lyncut-api-key | Server-to-server, CI, partner integrations |
| Session cookie | Cookie: lyncut_session=... | LynCut web and desktop apps only |
Auth errors
| Status | Meaning |
|---|---|
| 401 Unauthorized | Missing, expired, or revoked credential |
| 403 Forbidden | Valid credential without the required scope or plan feature |
| 429 Too Many Requests | Key exceeded its rate limit — back off and retry |
Was this page helpful?