API tokens

translateQuesta guida non è ancora stata tradotta nella Sua lingua.

API tokens are how external systems (your website, your mobile app, a partner portal) call the LegalCloud API. This page covers what tokens are, how to create them, how to limit them, and how to replace them safely.

What is an API token?

A token is a long opaque string that starts with lc_. You send it in the Authorization header of every request:

GET /api/documents HTTP/1.1
Host: api.legalcloud.info
Authorization: Bearer lc_...

LegalCloud validates the token, identifies your organization and returns only that organization's data.

Token types

Scopes

An application token can be created with all the permissions of the member who creates it, or narrowed to a subset of these scopes:

A token never gets more rights than the role of the member that created it. Give each integration only the scopes it needs: a website that only reads documents needs documents:read.

Token limits by plan

The number of tokens, the monthly API calls and the per-minute rate depend on your plan. They are shown in Organization → API and on the pricing page. When you exceed the quota or the rate limit the API answers 429 (see Errors reference).

Creating a token

1. In the dashboard, go to Organization → API.
2. Click Generate new token.
3. Enter a label (for example mobile-app-prod), choose the type and, optionally, the scopes and an expiry date.
4. Click Generate.

The full token is shown in a copyable field. Store it in your secret manager (1Password, Bitwarden, AWS Secrets Manager…) immediately.

Using the token

curl -H "Authorization: Bearer YOUR_TOKEN" \
     https://api.legalcloud.info/api/documents

In JavaScript:

const response = await fetch("https://api.legalcloud.info/api/documents", {
  headers: { Authorization: `Bearer ${token}` },
});
const { data } = await response.json();

In Python:

import requests
headers = {"Authorization": f"Bearer {token}"}
response = requests.get("https://api.legalcloud.info/api/documents", headers=headers, timeout=15)

In PHP:

$ch = curl_init("https://api.legalcloud.info/api/documents");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer $token"]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

Regenerating a token

Replace tokens periodically (we recommend every 90 days) and immediately if you suspect a leak:

1. In Organization → API, find the token and click Regenerate. LegalCloud revokes the old token and creates a new one with the same label and expiry.
2. Update your application with the new token.

If you need zero downtime, create a second token first, deploy it, and then revoke the old one.

Revoking a token

Go to Organization → API, find the token and click Revoke. The change is immediate: any subsequent request with that token returns 401 Unauthorized. A revoked token can be deleted permanently afterwards.

The same actions are available through the API (POST /api/account/tokens/{id}/regenerate, DELETE /api/account/tokens/{id}) with a token that has the organization:write scope.

Security best practices

• Never commit tokens to git. Use environment variables or a secret manager.
• Never expose application tokens in client-side code. Tokens are for server-side use. For browser-side use, use the public address (/d/{hash}) or a document token.
• Always use HTTPS. Tokens sent over plain HTTP can be intercepted.
• Use the narrowest scopes and set an expiry date when the integration is temporary.
• Replace tokens on personnel changes.
• Monitor token usage. The dashboard shows when each token was last used and how many calls it made. If a token you don't recognize shows recent activity, revoke it immediately.

Next steps

• Quickstart: install in 5 minutes
• Your first document
• API reference: authentication

Ultimo aggiornamento: 2026-10-27