> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lexera.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication: Bearer Tokens for the Lexera MCP API

> API keys, Bearer scheme, HTTPS-only enforcement, and 401 Unauthorized handling for the Lexera Protocol API.

Lexera uses HTTP Bearer authentication for all paid and authenticated endpoints. You pass a single API key in the `Authorization` header on every request. Some public PLG tools, such as statutory audits, can be accessed without a key. All requests must use HTTPS; plain HTTP connections are rejected.

## API keys

Generate and manage API keys from the [Lexera Developer Dashboard](https://lexera.dev/dashboard). Keys follow the format `lex_...`.

Example key:

```text theme={null}
lex_82bea57b8c3fd39f6907ccb1130a6a0cbb6d8e956ff14a88
```

<Warning>
  Never share your API key in client-side code, public repositories, or support tickets. Treat it like a password. If a key is exposed, revoke it immediately in the Developer Dashboard and rotate to a new key.
</Warning>

## Sending the token

Include the key in the `Authorization` header as a Bearer token on every request.

<CodeGroup>
  ```js theme={null}
  await fetch("https://lexera.dev/mcp-server/sse", {
    headers: {
      "Authorization": "Bearer lex_82bea57b8c3fd39f6907ccb1130a6a0cbb6d8e956ff14a88"
    }
  });
  ```

  ```bash theme={null}
  curl -H "Authorization: Bearer lex_82bea57b8c3fd39f6907ccb1130a6a0cbb6d8e956ff14a88" \
    https://lexera.dev/mcp-server/sse
  ```
</CodeGroup>

## Unauthenticated tools

The following tool is part of the public PLG funnel and does not require authentication:

* `lexera_local_statutory_audit` — rapid automated compliance check against local statutory laws.

All other tools, including `lexera_route_to_specialist` and `lexera_get_order_status`, require a valid Bearer token. For details on the statutory audit tool, see the [lexera\_local\_statutory\_audit reference](/tools/lexera-local-statutory-audit).

## HTTPS requirement

<Warning>
  All requests to the Lexera API must use HTTPS. Plain HTTP requests fail immediately. Ensure your client enforces TLS and does not downgrade to HTTP.
</Warning>

## Error responses

<Note>
  Missing, invalid, or expired API keys return `401 Unauthorized`. Verify that your `Authorization` header is correctly formatted with the `Bearer` prefix and that the key has not been revoked.
</Note>

For a complete list of error signatures and streamed error payloads, see the [Errors reference](/reference/errors).