Authentication

API Key Authentication

All /v1/* endpoints require an API key passed as a Bearer token in the Authorization header.

curl -X POST https://api.liyaengine.ai/v1/run \
  -H "Authorization: Bearer liya_F9y2kQ8mZ1..." \
  -H "Content-Type: application/json" \
  -d '{ "domain": "...", "intent": "...", "input": { ... } }'

API keys are scoped to your tenant and carry all domain and intent permissions associated with your account.

Key format

Keys are prefixed with liya_ followed by a random 32-byte token. The full key is only shown once — at creation or rotation. The dashboard shows a masked preview (e.g. liya_F9y-...o4k) for identification.

Getting your key

1. Sign up at liyaengine.ai/signup
2. Verify your email address
3. Your API key is generated automatically on account creation — copy it from the API Keys page before leaving

Rotating your key

Keys are issued per environment. Rotate the key for a specific environment:

POST https://api.liyaengine.ai/dashboard/environments/:id/api-key/rotate
Authorization: Bearer <dashboard_jwt>

Rotating generates a new key and immediately invalidates the old one. The full key is returned once in the response — save it.

{
  "success": true,
  "data": {
    "apiKey": "liya_F9y2kQ8mZ1...",
    "apiKeyPreview": "liya_F9y2kQ8...m1w"
  },
  "message": "Save this key now — it will not be shown again."
}

A legacy tenant-wide POST /dashboard/api-key/rotate (no environment id) still works too, for tenants created before environments existed.

Dashboard Authentication (JWT)

The dashboard web app (app.liyaengine.ai/dashboard) uses email/password login and issues a short-lived JWT for dashboard API calls.

Signup

POST https://api.liyaengine.ai/auth/signup
Content-Type: application/json

{
  "companyName": "Acme Corp",
  "email": "[email protected]",
  "password": "...",
  "fullName": "Jane Smith"    // optional
}

Response

{
  "success": true,
  "data": {
    "token": "<jwt>",
    "user": { "id": "...", "email": "[email protected]", "role": "owner" },
    "tenant": { "tenantId": "acme-corp", "tenantName": "Acme Corp", "plan": "starter" },
    "apiKey": "liya_F9y2kQ8mZ1..."
  }
}

The apiKey is only returned at signup. Store it securely. A verification email is sent automatically — the dashboard enforces email verification before full access.

Login

POST https://api.liyaengine.ai/auth/login
Content-Type: application/json

{
  "email": "[email protected]",
  "password": "..."
}

JWT usage

Pass the JWT as a Bearer token for all /dashboard/* endpoints:

Authorization: Bearer <jwt>

JWTs expire after 7 days by default. Call POST /auth/refresh (with your current, still-valid JWT) to get a new one. GET /auth/me returns the current user/tenant but does not reissue a token.

Error codes