Authentication
Authenticate with a JWT Bearer token
LCE API definitions use HTTP Bearer authentication with JSON Web Tokens (JWTs). Send a valid token with every protected API request.
Send an authenticated request
Add the token to the HTTP Authorization header:
Authorization: Bearer <jwt-token>Example:
curl --request POST \
--url "https://api.example.com/metadata/query/languages" \
--header "Authorization: Bearer $LCE_TOKEN" \
--header "Content-Type: application/json" \
--data '{"tenantId":1,"pageIndex":0,"pageSize":20}'Token lifecycle
1. Obtain
Use the credential flow approved for your Lidia environment.
2. Store
Keep tokens and client secrets in a secure server-side store.
3. Send
Use HTTPS and attach the Bearer token to each protected request.
4. Renew
Replace expired tokens according to your configured credential flow.
Authentication and authorization
Handle access errors
| Status | Meaning | What to check |
|---|---|---|
401 |
The request is not authenticated. | Missing header, malformed Bearer value, invalid signature or expired token. |
403 |
The identity is authenticated but not allowed to complete the operation. | Assigned role, operation permission, tenant access and application context. |
Security practices
- Use HTTPS for every environment, including non-production environments.
- Keep long-lived credentials out of browser bundles, mobile applications and source control.
- Prefer a trusted backend or backend-for-frontend for customer-facing applications.
- Grant the minimum roles and permissions required by the integration.
- Use separate credentials for development, test, staging and production.
- Do not log tokens, secrets or full authorization headers.
- Rotate credentials and handle token expiry without retry loops.