Authentication Overview
The Lexabit API authenticates requests with bearer tokens issued by Laravel Sanctum. Every authenticated endpoint declares an HTTP bearer security scheme — you authenticate by sending a token, not a session cookie.
Ways to authenticate
Which method you use depends on who is calling. They all end up as a bearer
token in the Authorization header:
| Caller | Method | Where |
|---|---|---|
| A person signing in | User bearer token (POST /auth/v1/login) | This page + Bearer Tokens |
| Your own scripts and tooling, acting as yourself | A personal access token (is literally you) | Personal Access Tokens |
| Your own server or integration | An App with an API key or client credentials | Apps & API Keys |
| A third-party product, acting for your customers with their consent | An OAuth Connector (authorization code + PKCE) | Connectors & OAuth |
| A third-party product or AI agent that should see what a user sees | A Connector with delegated access (user opt-in, revocable) | Delegated Access |
| An MCP client | An OAuth Connector (OAuth 2.1 + PKCE), ideally with delegated access | Connecting an MCP |
The rest of this page covers the user-token case; the linked pages cover the others. Unsure which fits? The rule of thumb: tooling you operate → a personal access token; someone else's product or a hosted AI agent → a Connector, with delegated access when it should work with everything the user can see.
Obtaining a token
Send your credentials to the login endpoint:
POST /auth/v1/login
If you don't have an account yet, create one first:
POST /auth/v1/register
Both endpoints live under the Authentication product area. On success, login returns a bearer token that you use for all subsequent requests. See Bearer Tokens for the full request/response shape and how to refresh, revoke, or reset credentials.
Sending the token
Include the token on every authenticated request as an Authorization header:
curl https://api.lexabit.com/auth/v1/me \
-H "Authorization: Bearer <token>"
Token lifecycle
Tokens can be refreshed and revoked. See Bearer Tokens for the specific endpoints and when to use each.
Scopes and tenancy
A token authenticates who you are; it does not by itself determine what you can see. Most requests are also evaluated against an operating scope that controls which tenant's or entity's data is visible to you. See Scopes & Workspaces for details.
Authentication vs. the right to data
Everything in this section is about authenticating to the Lexabit platform and API — proving who you are and what you may do in Lexabit. It is a separate concept from the right or authority to obtain the underlying data itself.
The clearest example is bank data: an authenticated, authorized API client still cannot read live bank account data until the account holder has granted a PSD2 consent at their bank. That consent flow belongs to the Account Tracking product — not to platform authentication — and is covered in the PSD2 Consent Flow guide.