Authentication
Every request uses a Seller- or marketplace-scoped API key issued by LicenChain during Seller onboarding. Send it as a bearer token:
Authorization: Bearer <your API key>Content-Type: application/jsonHow the key is used
Section titled “How the key is used”- The key alone identifies the Seller. LicenChain never accepts a Seller ID or marketplace ID from a request body or header as the basis for authorization. A request can only act on products, licensing requests and licenses that belong to the key’s Seller scope.
- Server-side only. Store the key in a secret manager and load it at runtime. Do not embed it in browser or mobile code, agent prompts, MCP tool definitions or tool outputs.
- Separate keys per environment. Sandbox and Production keys are different and only work against their own base URL.
- Rotation. Request a new key, deploy it, then ask LicenChain to revoke the old key. A revoked or
expired key returns
401 unauthenticated.
Failure responses
Section titled “Failure responses”| Status | code |
Meaning |
|---|---|---|
401 |
unauthenticated |
Missing, malformed, expired or revoked key. Do not retry with the same key. |
403 |
forbidden |
The key is valid but not permitted for this operation. |
What the key is not
Section titled “What the key is not”The Seller API key authenticates your backend to LicenChain. It is not a user credential and it does not sign users in to your offering. End-user authentication is handled by your own identity provider — see MCP & agent access control.
Webhook deliveries from LicenChain are authenticated separately with a signing secret — see
Webhooks. In the OpenAPI target document the Seller API
key is the sellerApiKey scheme (HTTP Bearer) and applies to the two Seller → LicenChain operations;
both webhook operations override it with their own webhookSignature scheme.