#LinkCodeDOCS
Docs/Authentication

Management security

Controlled rollout

Keys belong on the server.

Secure LinkCode integrations with public request rules, server-side API keys, workspace scopes, key rotation and safe secret handling.

01

Public resolution needs no key

Human resolution, JSON resolution and public manifests expose only owner-published information. They do not accept a secret and are safe to call from browsers.

02

Management requests use Bearer keys

POST/v1/codesControlled rollout
Authorization: Bearer lc_live_your_server_side_key
Content-Type: application/json
Idempotency-Key: 9f0a63d4-6cb0-4bf1-9bf0-8653c38bdd39
03

Security rules

  • ✓Store keys only in server-side environment variables or a secret manager.
  • ✓Never embed lc_live_* keys in browser JavaScript, mobile bundles, Git or logs.
  • ✓Use one key per environment and workspace.
  • ✓Rotate immediately after suspected exposure.
  • ✓Send an Idempotency-Key on every create or mutation request.