Authentication | Owlat Docs

Secure API access with workspace-scoped API keys.

API key format

Owlat validates keys with a live prefix format:

lm_live_...

curl "https://<deployment>.convex.site/api/v1/contacts" \
  -H "Authorization: Bearer lm_live_your_key"

Authorization: <api_key> (without Bearer) is also accepted, but Bearer is recommended.

{
  "error": {
    "message": "Missing or invalid Authorization header. Use: Authorization: Bearer <api_key>",
    "code": "unauthorized"
  }
}

{
  "error": {
    "message": "Invalid API key format",
    "code": "unauthorized"
  }
}

{
  "error": {
    "message": "Invalid API key",
    "code": "unauthorized"
  }
}

{
  "error": {
    "message": "Rate limit exceeded. Maximum 10 requests per second.",
    "code": "rate_limited"
  }
}