Authentication

Authentication

All LMIF API requests require authentication using an API key.

API Keys

LMIF uses bearer token authentication. Include your API key in the Authorization header:

Authorization: Bearer lmif_live_xxx

Key Types

Key Prefix	Environment	Purpose
lmif_test_	Sandbox	Development and testing
lmif_live_	Production	Live integrations

Caution

Never expose your API keys in client-side code. Always make LMIF API calls from your server.

Getting API Keys

1. Sign up at lookmaimfamous.com/developers
2. Complete platform verification
3. Receive your sandbox key immediately
4. Apply for production access when ready

Production Access Requirements

To receive production API keys, your platform must:

• Demonstrate a working sandbox integration
• Agree to the LMIF Platform Agreement
• Implement required webhook handlers
• Pass a basic compliance review

Using the SDK

The TypeScript SDK handles authentication automatically:

import { LMIFClient } from '@lookmaimfamous/lmif';

const lmif = new LMIFClient({
  apiKey: process.env.LMIF_API_KEY,
});

// All requests are automatically authenticated
const result = await lmif.identity.check({ name, imageUrl });

Direct API Calls

For direct HTTP requests, include the header:

curl -X POST https://api.lookmaimfamous.com/v1/lmif/identity/check \
  -H "Authorization: Bearer lmif_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{"name": "John Doe", "imageUrl": "https://example.com/image.jpg"}'

Key Security Best Practices

1. Store keys securely - Use environment variables or a secrets manager
2. Never commit keys - Add .env to your .gitignore
3. Rotate regularly - Rotate keys every 90 days
4. Use least privilege - Create separate keys for different environments
5. Monitor usage - Check the dashboard for unusual activity

Key Management

Rotating Keys

You can rotate API keys from your dashboard:

1. Go to Settings → API Keys
2. Click Rotate next to the key
3. You’ll have 24 hours to update your integration
4. The old key will be invalidated after 24 hours

Revoking Keys

If a key is compromised:

1. Go to Settings → API Keys
2. Click Revoke next to the key
3. The key is immediately invalidated
4. Generate a new key

Danger

Revoking a key is immediate and cannot be undone. Ensure you have a replacement ready.

Rate Limiting

API keys are subject to rate limits:

Plan	Requests/minute	Requests/day
Sandbox	60	1,000
Basic	300	50,000
Standard	1,000	500,000
Enterprise	Custom	Custom

See Rate Limits for details.

Error Responses

Authentication errors return 401 Unauthorized:

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid API key",
    "details": "The provided API key is invalid or has been revoked"
  }
}

Common authentication errors:

Code	Description
UNAUTHORIZED	Invalid or missing API key
KEY_REVOKED	The API key has been revoked
KEY_EXPIRED	The API key has expired (post-rotation)
WRONG_ENVIRONMENT	Using sandbox key in production or vice versa