Authentication

The Lexsis Storefront API supports two authentication methods.

API Keys

API keys use the lx_ prefix and are scoped to your organization.

Each key has:

• Tenant scope — tied to one brand/organization
• Workspace — default workspace for API calls
• Permissions — read, write, or admin

Creating a Key

Navigate to Settings → API Keys → Create in your Lexsis dashboard.

Using a Key

Pass your API key in the X-API-Key header:

X-API-Key: lx_your_key_here

OAuth 2.1

The platform implements RFC 9728 (OAuth Protected Resource Metadata) for programmatic access.

Well-known Endpoints

Flow

1. Client discovers auth requirements via protected resource metadata
2. Client authenticates via authorization server
3. Bearer token issued for subsequent API calls
4. Scopes: mcp:tools

Workspace Scoping

API calls are scoped to a workspace. The workspace resolves from:

1. X-Workspace-Id header — optional override (must belong to same tenant)
2. API key default — the workspace set when the key was created

To override the default workspace for a specific request:

X-Workspace-Id: ws_your_workspace_id

Connection Methods

Permissions