Authentication

Every request needs an ApiLux API key sent in the Authorization header.

Bearer token

ApiLux keys always start with apl_. Send one with every request:

bash

Authorization: Bearer apl_YOUR_API_KEY

Store it in the APILUX_API_KEY environment variable and keep it out of git.

Situation	Result
Freshly created key	The full value appears exactly once. We store only a hash and cannot show it again.
Revoked key	`401 auth_revoked`. Not reversible — create a new key.
Expired key	`401 auth_expired`. Expiry is optional at creation time.
Wrong or unknown key	`401 auth_invalid`.

Use separate keys for production, staging and local machines. Revoke immediately if one leaks — the others are unaffected.