Authentication and scopes
Base URL: https://api.lelemon.cl/v2. Everything is HTTPS and JSON.
Send your key as a bearer token:
Keys belong to the organization, never to a person. Keep them on your server: anyone can read a key shipped in a browser or a mobile app.
Key types
| Prefix | Use |
|---|---|
lel_live_... | Your organization's data |
Keys are created, rotated and revoked in the dashboard, with the session of a person. No key can manage keys, so a leaked key cannot mint others. See API keys.
Scopes
Each key carries scopes written resource:action. A route that needs a scope the key lacks answers 403 scope_missing, and detail names the scope. GET /v2/me returns the scopes of the key you are using, and the scope catalog lists all of them.
Two scopes cost money or move data outside Lelemon, so they are separate:
cases:conversewrites as the contact, which runs the agent and spends model tokens.actions:writeandwebhooks:writedecide where your conversation data goes.
Acting on a subaccount
A platform key adds Lelemon-Subaccount: sub_... to any request. See Run Lelemon for your customers.