Authentication: Bearer Tokens for the Lexera MCP API

API keys, Bearer scheme, HTTPS-only enforcement, and 401 Unauthorized handling for the Lexera Protocol API.

Lexera uses HTTP Bearer authentication for all paid and authenticated endpoints. You pass a single API key in the Authorization header on every request. Some public PLG tools, such as statutory audits, can be accessed without a key. All requests must use HTTPS; plain HTTP connections are rejected.

API keys

Generate and manage API keys from the Lexera Developer Dashboard. Keys follow the format lex_....

Example key:

lex_82bea57b8c3fd39f6907ccb1130a6a0cbb6d8e956ff14a88

Never share your API key in client-side code, public repositories, or support tickets. Treat it like a password. If a key is exposed, revoke it immediately in the Developer Dashboard and rotate to a new key.

Sending the token

Include the key in the Authorization header as a Bearer token on every request.

await fetch("https://lexera.dev/mcp-server/sse", {
  headers: {
    "Authorization": "Bearer lex_82bea57b8c3fd39f6907ccb1130a6a0cbb6d8e956ff14a88"
  }
});

Unauthenticated tools

The following tool is part of the public PLG funnel and does not require authentication:

• lexera_local_statutory_audit — rapid automated compliance check against local statutory laws.

All other tools, including lexera_route_to_specialist and lexera_get_order_status, require a valid Bearer token. For details on the statutory audit tool, see the lexera_local_statutory_audit reference.

HTTPS requirement

All requests to the Lexera API must use HTTPS. Plain HTTP requests fail immediately. Ensure your client enforces TLS and does not downgrade to HTTP.

Error responses

Missing, invalid, or expired API keys return 401 Unauthorized. Verify that your Authorization header is correctly formatted with the Bearer prefix and that the key has not been revoked.

For a complete list of error signatures and streamed error payloads, see the Errors reference.