Lanewise

Authentication

Every request to the Lanewise API must be authenticated with an API key. In this guide, we look at how keys work, what they can access, and what happens when authentication fails.

API keys

Create and manage keys in the API keys section of the dashboard. A key belongs to a team: it can only see and change that team's data, and its requests count towards that team's rate limit.

Send the key in the X-API-KEY header:

Example request with an API key

curl https://api.lanewise.app/v1/pois \
  -H "X-API-KEY: {YOUR_API_KEY}"

The full key is shown only once, when you create it. Lanewise stores a hash, so it cannot show the key again; the dashboard shows the last four characters to help you tell keys apart. Keep keys out of client-side code and version control, and delete any key you suspect has leaked.

Permissions

Each key has its own set of permissions, chosen when you create it. A request that needs a permission the key lacks returns a 403.

  • Name
    read-pois, create-pois, update-pois, delete-pois
    Description

    List, retrieve, create, update and delete POIs. read-pois also grants access to the geolocation endpoints.

  • Name
    read-attributes, create-attributes, update-attributes, delete-attributes
    Description

    Manage the attributes of your team.

  • Name
    read-categories, create-categories, update-categories, delete-categories
    Description

    Manage the categories of your team.

Use the API key endpoint to check which permissions a key has.

Expiry and deactivation

A key can have an expiry date, and you can deactivate and reactivate it from the dashboard at any time. Expired, deactivated and deleted keys are rejected.

Failed authentication

A missing, unknown, expired or inactive key returns a 401:

401 Unauthorized

{
  "message": "Missing or invalid API key. Send an active key in the X-API-KEY header."
}

If your team has no active plan, requests return a 403 with the message Your team does not have an active plan.