API Keys

API keys authenticate your application's requests to the Lira verification API. Each key is scoped to an environment (sandbox or live) and belongs to your organization. You create and manage keys from the Lira dashboard.

Create an API key

1. Sign in to the dashboard. Go to app.uselira.com and sign in with your Lira account.

2. Open the API Keys page. From the sidebar, open API Keys. This page lists every key in your organization along with its environment, status, and when it was last used.

3. Create a new key. Click Create API key, give it a descriptive name (for example, Production server or Local dev), and choose the environment:

   • Sandbox — for development and testing. No real verifications are processed and nothing is billed.
   • Live — for production traffic. Real queries are made and each verification is billed.

4. Copy and store the key. The full key is shown once, immediately after it is created. Copy it right away and store it in an environment variable or secrets manager.

Key format

Keys follow the pattern lira_{environment}_{hex}:

lira_sandbox_a3f08c1d4e2b9f3c1e5d7a8b2c4f6e0d1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c

Each key page in the dashboard also shows a shortened key prefix (e.g. lira_sandbox_a3f0...) so you can identify which key is in use without exposing the full value.

Authenticate requests with an API key

Pass the key in the X-API-Key header on every verification request:

curl -X POST https://api.uselira.com/api/v1/verify/account \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "accountNumber": "0123456789",
    "country": "NG",
    "bankCode": "000014"
  }'

API keys are used only for verification endpoints (/verify/...). There is no login or token exchange — the key is all you need to call the API.

View and revoke keys

The API Keys page in the dashboard lists all keys for your organization. For each key you can see its name, environment, status, and last-used time. The full key value is never shown again after creation — only the prefix.

To revoke a key, open it in the dashboard and choose Revoke. Revocation is immediate and permanent: any request using that key is rejected right away. To restore access, create a new key and update your application's environment variables.

Key security

Key rotation

Rotate your API key when:

• A key may have been exposed (in logs, a git commit, an error message, etc.)
• A team member with key access leaves your organization
• Your security policy requires periodic rotation

To rotate a key from the dashboard:

1. Create a new API key with the same environment.
2. Store the new key value in your secrets manager or environment variable.
3. Deploy the updated environment variable to your application.
4. Revoke the old key once the new one is live.

Sandbox vs live

See Environments for sandbox test data and switching instructions.

Next steps