Authentication

External integrations authenticate using API keys. Interactive users (web/mobile) use JWT session tokens via the same header, but partner integrations should use API keys exclusively.

API key format

API keys follow this format:

lise-apikey_<login>_<secret>

• <login> — a unique login identifier assigned when the key is created.
• <secret> — a high-entropy secret shown only once at key creation time.

Example:

lise-apikey_a1b2c3d4e5f6g7h8_i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6

Sending the API key

Pass the key in the X-Token-Auth request header:

X-Token-Auth: lise-apikey_<login>_<secret>

You may also prefix the key with Bearer (both forms are accepted):

X-Token-Auth: Bearer lise-apikey_<login>_<secret>

Obtaining an API key

API keys are provisioned by a Lise administrator for approved integration
accounts. Contact your Lise account manager and specify the target environment
(sandbox or production) and the account that the key must access.

The createApiKey mutation is restricted to Lise administrators and is not
available to regular partner accounts.

🚧

The plaintext API key is disclosed only once. Store it securely when it is
delivered to you. If you lose it, ask your Lise account manager to revoke it
and issue a replacement.

Revoking a key

Contact your Lise account manager to revoke or rotate a key. Revoked keys are
rejected on all subsequent requests.

Session behavior

When you authenticate with an API key, the server builds a session scoped to the key's account. Two-factor authentication is automatically satisfied for API key credentials — no additional 2FA step is required.

FIX Logon

The same API key authenticates FIX sessions. On Logon (35=A), set:

• Username (553) = the full key lise-apikey_<login>_<secret> (Password ignored), or
• Username (553) = <login> and Password (554) = <secret>

See FIX market data for session parameters and supported messages.

Security best practices

• Store API keys in a secrets manager, never in source code or client-side bundles.
• Use separate keys per environment (sandbox vs production).
• Rotate keys periodically and revoke unused keys.
• Restrict key creation to trusted administrators on your side.

Unauthenticated operations

A small set of mutations (sign-up, login, password reset) are available without authentication. All other mutations require a valid X-Token-Auth header. See the API Reference for the full list.