Start
Authentication
Secret keys (lh_sk_) for server calls, publishable keys (lh_pk_) for logos in the browser, and how to send them.
Two kinds of key
Create keys on the API keys page of the dashboard. Each key is shown once, when you create it; we store only a hash, so a lost key cannot be recovered, only replaced.
| Prefix | Kind | Use it from | It can call |
|---|---|---|---|
| lh_sk_ | Secret | Your server, a script, an MCP client. Never a browser or an app bundle. | Every endpoint: brands, batch, search, /v1/me, the MCP server and the logo CDN |
| lh_pk_ | Publishable | Front-end code, where anyone can read it | Brand search and the logo CDN only. It cannot spend lookups. |
The prefixes never change, so a leaked lh_sk_ key is easy to spot in a log, a commit or a code search.
Sending a key
Send the key in the Authorization header as a bearer token. This is the form every example in these docs uses:
curl https://brandidentityapi.com/v1/brands/stripe.com \
-H "Authorization: Bearer $BRAND_IDENTITY_API_KEY"An X-Api-Key header works too, for tools that reserve Authorization for something else:
curl https://brandidentityapi.com/v1/brands/stripe.com \
-H "X-Api-Key: $BRAND_IDENTITY_API_KEY"The REST API never reads a key from the query string, so a key cannot end up in a server log or a browser history by accident. The logo CDN is the one exception, because an img tag cannot send headers: it takes ?key=, and that key should be a publishable one.
The API answers any origin (CORS is open) and never uses cookies, so there is no session to steal and nothing to configure for cross-origin calls.
Publishable keys in the browser
A publishable key is safe to ship in front-end code because it cannot read brand records or spend your credits. Use one for:
- an autocomplete box that calls /v1/search as the user types;
- logo URLs for brands that may not be indexed yet: with a key, the logo CDN crawls an unknown domain on the spot instead of showing the fallback.
<img src="https://brandidentityapi.com/logo/stripe.com?size=64&key=lh_pk_your_key" alt="Stripe logo" />When a key is refused
| Status | Code | Why |
|---|---|---|
| 401 | unauthorized | No key was sent, or the key is not valid (mistyped, revoked or deleted). |
| 403 | forbidden | A publishable key called an endpoint that needs a secret key, or the account is suspended. |
On the logo CDN a bad key never breaks the image: the request is served as if it had no key, and the response says so in an X-Api-Key-Status: invalid header.
Rotating a key
You can hold several keys at once, which makes rotation a three-step job with no downtime:
- create a new key and deploy it alongside the old one;
- watch the old key's last-used time on the API keys page until it stops moving;
- revoke the old key. Revocation takes effect on the next request.