API Keys

API keys are the authentication mechanism against https://api.pos.lxsyscr.com. Each API key belongs to a single tenant and carries its own set of scopes and limits.

Anatomy

Every LX CloudPos API key follows this format:

lxs_live_a1b2c3d4_0011223344556677889900aabbccddeeff00112233445566
└──┬──┘  └──┬──┘  └────────────────────┬────────────────────┘
   1         2                          3

Total: 64 characters + the literal scope = 73 characters.

How it’s stored server-side

LX CloudPos never stores the full API key. Only the following persist in the database:

• The prefix in plain text, to identify the API key in logs and in the CRM UI.
• A SHA-256 hash of the full value, to verify incoming requests.

If the API key is lost, it cannot be recovered: a rotation must be requested.

How to get an API key

1. Contact the administrator of the LX CloudPos account.
2. The admin opens the CRM → Integrations module → New API Key.
3. Configures: name, tenant, scopes, and webhook URL (optional).
4. When created, the system shows the full API key only once.
5. The admin must deliver it through a secure channel (never plain email — 1Password Send, Bitwarden Send, Signal, etc. are recommended).
6. The API key must be saved in the secrets manager before closing the CRM window.

Storage best practices

Do:

• Environment variables (process.env.LXS_API_KEY).
• Secret Manager (Google, AWS, Azure).
• HashiCorp Vault.
• Doppler, Infisical, or similar.

Don’t:

• Hardcode it in source code.
• Commit .env files to Git (verify .gitignore).
• Put it in public frontend configuration — the API key must live only in the backend.
• Log it in structured logs without masking the value.

Limits per API key