Authenticate the LiveAPISec CLI

Create an API key

Open the dashboard and go to Settings → Developer API → Create API key. The las_dev_... key is shown only once, so store it in your password manager or CI secret store immediately. The key is encrypted server-side (AES-256).

export LIVEAPISEC_API_KEY=las_dev_...
liveapisec whoami

Log in with the device flow (recommended locally)

liveapisec login works like aws sso login or gcloud auth login: the CLI prints a one-time code, opens the approval page, and saves a fresh key to ~/.config/liveapisec/config.json with mode 0600. The login key expires after 30 days and covers all projects in your organisation.

$ liveapisec login
  First, copy your one-time code:  WDJB-MJHT
  Then open:  https://liveapisec.com/cli/authorize?code=WDJB-MJHT

✓ Logged in — acme
  key:     las_dev_ab12…
  expires: 2026-11-01
✓ Token saved to /home/you/.config/liveapisec/config.json

On a headless server or over SSH, add --no-browser (the URL is printed), or pass an existing key with liveapisec login --token las_dev_....

Authenticate in CI/CD

In pipelines, skip the login and inject the key as a secret. The environment variable takes precedence over any saved config, so pipelines are unaffected by a developer login on the same machine.

env:
  LIVEAPISEC_API_KEY: ${{ secrets.LIVEAPISEC_KEY }}

export LIVEAPISEC_API_KEY="$LIVEAPISEC_KEY"
export LIVEAPISEC_API_URL=https://api.liveapisec.com   # optional

Key precedence

The CLI resolves credentials in this order: --api-key / --api-url flags → LIVEAPISEC_API_KEY / LIVEAPISEC_API_URL environment variables → the saved config file. This lets you override a saved login for a single command without deleting it.

liveapisec config            # where the key is stored
liveapisec config --clear    # remove the saved config
liveapisec whoami            # org, key prefix, scopes, expiry
liveapisec logout            # remove the saved token

Authenticate the API you are scanning

CLI login is separate from the credentials used against your target API. For the target, push accepts a JWT, bearer token, cookie, API key, or OAuth2 client credentials. For CI, prefer OAuth2 client credentials so the scanner fetches a fresh token at every scan instead of using a short-lived JWT.

liveapisec push --name my-api --base-url https://api.example.com \
  --auth-type oauth2 \
  --auth-token-url https://<your-idp>/oauth/token \
  --auth-client-id "$CLIENT_ID" --auth-client-secret "$CLIENT_SECRET" \
  --endpoint "GET /users"

Add --verify to confirm the target credentials work before a scan runs; it exits with code 2 on an expired or invalid token.

Fixing 401 and 403 errors

• 401 Unauthorized from the LiveAPISec API — the key is missing, revoked, or expired. Run liveapisec whoami and re-create the key.
• 401/403 from your target API — the target token is wrong. Re-push credentials and run push --verify.
• A pipeline unexpectedly uses a local login — set LIVEAPISEC_API_KEY explicitly and check precedence.
• The key was rotated — update the CI secret; old keys stay invalid.

FAQ

Where does the LiveAPISec CLI store the API key?

In `~/.config/liveapisec/config.json` with file mode 0600. Use `liveapisec config` to print the exact path and `liveapisec config --clear` to remove it.

Do I need to log in again in CI?

No. Set `LIVEAPISEC_API_KEY` as a CI secret. The environment variable takes precedence over any saved config, so no interactive login is required.

How long does a login key last?

A key created by `liveapisec login` expires after 30 days. Permanent Developer API keys created in Settings do not expire until you revoke them.