Authentication

API keys

All requests authenticate with a project API key (lb-sk_…), created and managed in the console. Send it in the Authorization header using the Token scheme:

Authorization: Token lb-sk_your_key_here

The SDK reads it from the apiKey option (or UNISPEC_API_KEY):

import { createMemoryClient } from "@unispec-ai/sdk";

const memory = createMemoryClient({ apiKey: process.env.UNISPEC_API_KEY });

Environment variables

• UNISPEC_API_KEY — API key (canonical).
• UNISPEC_BASE_URL — platform base URL override.

The legacy LIBRA_API_KEY / LIBRA_BASE_URL names are still honored as deprecated fallbacks for one release cycle.

API keys also authenticate the contracts registry — registry endpoints accept Authorization: Bearer lb-sk_… (or Token), which is how unispec publish works in CI. See CI publishing.

Scopes

Keys carry scopes that gate access:

A 401 means the key is missing or invalid; a 403 means it lacks the required scope for that endpoint.

Keep keys secret

Never commit API keys or expose them in client-side code. Use environment variables and your platform's secret manager. Rotate or revoke keys anytime from the console.