Getting started

Authentication

Every request carries one of your business's API keys.

Sending a key#

Send the key in the Authorization header, after the word Bearer:

Authorization: Bearer lmu_live_…

curl "https://business.linemeup.in/api/v1/business" \
  -H "Authorization: Bearer $LINEMEUP_API_KEY"

const res = await fetch("https://business.linemeup.in/api/v1/business", {
  headers: {
    Authorization: `Bearer ${process.env.LINEMEUP_API_KEY}`,
  },
});
if (!res.ok) throw new Error(`Line Me Up answered ${res.status}`);
const answer = await res.json();

import os
import requests

res = requests.get(
    "https://business.linemeup.in/api/v1/business",
    headers={
        "Authorization": f"Bearer {os.environ['LINEMEUP_API_KEY']}",
    },
    timeout=10,
)
res.raise_for_status()
answer = res.json()

<?php
$ch = curl_init("https://business.linemeup.in/api/v1/business");
curl_setopt_array($ch, [
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer " . getenv("LINEMEUP_API_KEY"),
    ],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 10,
]);
$answer = json_decode(curl_exec($ch), true);

Never put a key in a URL or a query string: URLs end up in logs, browser history and the analytics of every proxy in between. The API reads the header and nothing else.

Without a key, or with one we do not recognise, the answer is a 401:

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid API key"
  }
}

The message is the same whether the key is mistyped, revoked, expired or belonged to an owner who has left. Too many 401s from one address in a minute are answered 429 for the rest of that minute.

What a key looks like#

lmu_live_  +  43 letters and digits (A–Z, a–z, 0–9)
└─ prefix ─┘   └──────── 32 random bytes ────────┘

Every key starts lmu_live_, so a secret scanner — GitHub's, or your own — can recognise one that was committed by mistake. The rest is 32 random bytes written in base62, 52 characters in all.

Settings shows a key by its name, its last four characters and when it was last used — enough to tell keys apart, never enough to use one. We store only a SHA-256 hash of the whole key and compare it in constant time. That is why a key is shown once, when it is made, and never again: if it is lost, make a new one.

A business may hold 25 keys at once that are not revoked. A key may be given an expiry date up to two years ahead, or none; after it, the key answers 401 like a revoked one.

Storing a key safely#

• Keep it in an environment variable or your platform's secret store, read when the program starts. Every sample on this site reads LINEMEUP_API_KEY.
• Never commit it, paste it into a ticket or a chat, or log a request's headers. If one leaks, revoke it at once — see below.
• Think before putting a key in a browser, a mobile app or a public device's firmware. Anything shipped to somebody else's machine can be read. The safe default is to call the API from your server and let your page talk to your server; if you do call it from a browser, see below.
• One key per system. A CRM sync, a lobby screen and a desk button each get their own, with only the scopes they need, so revoking one stops one thing.

# /etc/line-me-up/env — readable by the service's own user only
LINEMEUP_API_KEY=lmu_live_…

Calling from a browser#

The API allows calls from a web page on any site: it answers with Access-Control-Allow-Origin: *, accepts the Authorization, Content-Type and Idempotency-Key headers, and lets your script read the RateLimit-* and Retry-After headers. It never sends or reads cookies — the key is the only credential, and requests are not sent with credentials.

• A key in browser code is visible to anyone who opens the page. They can copy it and do whatever its scopes allow, from anywhere, until it is revoked.
• If you must, use a key with only the read scope, limited to the lines and desks the page shows — a lobby screen, say — and revoke it the moment it is not needed.
• Anything that writes — adding a visit, calling one, cancelling one — belongs on your server.
• Whether a key goes in a page is your decision, and what is done with a key you published is your responsibility.

Rotating a key#

A key cannot be changed into another key. To rotate one, make the new key, deploy it, check in Settings that its Last used moves and the old one's stops, then revoke the old one. Both work at once for as long as you need, so nothing is refused in between.

A key's name, scopes, lines and desks can be edited without rotating it. The change applies to the very next request.

Revoking a key#

In Settings → Integrations, open the key and choose Revoke. It is refused from the next request on, everywhere, and cannot be switched back on. Revoked keys stay in the list, marked revoked, so the history of what each one did still has a name.

A key also stops working when the owner who made it is removed from the team or deactivated, and while the business's plan does not include API access — then every call answers 403 PLAN_LIMIT until it does again. Line Me Up's own staff can also revoke a key that is being misused, and record why.

What a key can never do#

A key acts as a manager of its business, narrowed by its scopes and its lines and desks. It is never an owner. That means it can never:

• reach a business other than its own;
• make, see or revoke API keys or webhook endpoints, including itself;
• change the team, the business's settings, its plan or its billing;
• act as a particular person at a desk — it has no desk of its own, so every desk action names the desk (POST /v1/desks/{deskId}/call-next);
• sign in to the staff app or the customer app, or call any address outside /api/v1.

Everything a key does is recorded in the business's activity, under the key's name — "via API key CRM sync" — beside the owner who made it.