API Authentication

All MeetLoyd API requests require authentication. This guide covers how to create, manage, and use API keys.

Key Types

Type	Prefix	Purpose
Live	sk_live_	Production use
Test	sk_test_	Development and testing (sandbox, no charges, relaxed rate limits)

Permissions

API keys can be scoped to specific permissions:

Permission	Description
agents:read	List and get agents
agents:write	Create, update, delete agents
conversations:read	List and get conversations
conversations:write	Create conversations, send messages
tasks:read	List and get tasks
tasks:write	Create, update, run tasks
workflows:read	List and get workflows
workflows:write	Create, update, run workflows
memory:read	Read memory values
memory:write	Set and delete memory
admin	Full administrative access

Rate Limits

Plan	Requests/min	Burst
Starter	120	200
Growth	500	800
Enterprise	5000	8000

Rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) are included in every response.

OAuth 2.0 (Enterprise)

Enterprise customers can use OAuth 2.0 Client Credentials flow for machine-to-machine authentication. Access tokens expire after 1 hour and must be refreshed.

Creating an API Key

From the Dashboard

1. Go to Settings > API Keys
2. Click + Create API Key
3. Name your key (e.g., "Production", "Development")
4. Select permissions scope
5. Click Create
6. Copy the key immediately -- it won't be shown again

Using API Keys

Include your API key in the Authorization header:

Authorization: Bearer sk_live_abc123...

Or with the SDK:

import { MeetLoyd } from '@meetloyd/client';
const client = new MeetLoyd({ apiKey: 'sk_live_abc123...' });

Key Management

View all your API keys under Settings > API Keys. Each key shows its name, prefix, creation date, and last used timestamp.

Revoking: Click Revoke on any key to immediately invalidate it.

Rotating: Click Rotate to generate a new key value while keeping the same key ID. Update your applications with the new key.

Security Best Practices

1. Never expose keys in code -- use environment variables
2. Use minimal permissions -- only grant the scopes your integration needs
3. Rotate keys regularly -- especially production keys
4. Monitor key usage -- check the dashboard for unusual patterns
5. Use different keys per environment -- separate keys for development, staging, and production

OAuth 2.0 Setup (Enterprise)

Enterprise customers can use the Client Credentials flow:

1. Contact your account manager to get a client_id and client_secret
2. Request tokens from https://auth.meetloyd.com/oauth/token with grant_type: client_credentials
3. Include the requested scopes
4. Use the returned access_token in the Authorization header
5. Implement token refresh before the 1-hour expiry

---

Next: Learn about Webhooks for receiving real-time events.