Authentication

lnkify supports two authentication methods. Both resolve to the same user identity.

Methods

Method	Header	Use Case
JWT Bearer Token	Authorization: Bearer <jwt>	Dashboard, web apps, session-based access
API Key	x-api-key: lf_live_<key>	CI/CD, scripts, programmatic access

API keys can also be sent as a Bearer token:

Authorization: Bearer lf_live_<key>

Obtaining Credentials

JWT (login)

Call the login mutation with email and password:

mutation {
  login(email: "user@example.com", password: "your-password") {
    token
    user { id name email }
  }
}

curl -X POST https://lnkify.io/graphql \
  -H "Content-Type: application/json" \
  -d '{"query": "mutation { login(email: \"user@example.com\", password: \"your-password\") { token user { id name email } } }"}'

JWT (signup)

mutation {
  signup(name: "Jane Doe", email: "jane@example.com", password: "secure-pass") {
    token
    user { id name email }
  }
}

API Key

Create an API key via the createApiKey mutation or the dashboard:

mutation {
  createApiKey(label: "My CLI tool") {
    apiKey { id prefix last4 createdAt }
    secret
  }
}

The secret field contains the full key (format: lf_live_...). It is only returned once. Store it securely.

Using Credentials

JWT Example

curl -X POST https://lnkify.io/graphql \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -d '{"query": "query { getUserInfo { name email } }"}'

API Key Example

curl -X POST https://lnkify.io/graphql \
  -H "Content-Type: application/json" \
  -H "x-api-key: lf_live_abc123def456" \
  -d '{"query": "query { lnkifyConnection { items { id lnkify target } totalCount } }"}'

Identity Resolution

The server resolves identity in this order:

1. Check x-api-key header — if present and valid, use the associated user
2. Check Authorization: Bearer header:
   • If the token starts with lf_live_ → treat as API key
   • Otherwise → treat as JWT
3. If no credentials → unauthenticated. Only public operations are accessible: login, signup, targetUrl/getTargetByLnkify, ping, and — unless REQUIRE_AUTH_FOR_CREATE=true — createLnkify.

Token Management

• JWT expiration: Tokens are issued with a fixed 7-day lifetime.
• JWT revocation (logout): Call the logout mutation with the token on the request. Its jti is added to a server-side revocation list so the token stops working immediately, before its natural expiry. Returns true when a token was revoked. API-key requests carry no JWT, so logout is a no-op for them (returns false).
• API key revocation: Call revokeApiKey — takes effect immediately.
• API key expiration: Set expiresAt at creation time (optional).
• Password reset: Use resetPassword mutation (requires current password).

mutation {
  logout
}

MCP Authentication

The MCP server uses the same headers and the same identity resolution. Pass x-api-key or Authorization headers to MCP requests at https://mcp.lnkify.io/.