# Authentication and scopes

Base URL: `https://api.lelemon.cl/v2`. Everything is HTTPS and JSON.

Send your key as a bearer token:

```bash title="cURL"
curl https://api.lelemon.cl/v2/me \
  -H "Authorization: Bearer $LELEMON_API_KEY"
```

```ts title="Node.js"
const lelemon = new Lelemon({ apiKey: process.env.LELEMON_API_KEY });
```


Keys belong to the organization, never to a person. Keep them on your server: anyone can read a key shipped in a browser or a mobile app.

## Key types

| Prefix | Use |
| --- | --- |
| `lel_live_...` | Your organization's data |

Keys are created, rotated and revoked in the dashboard, with the session of a person. No key can manage keys, so a leaked key cannot mint others. See [API keys](/guides/api-keys).

## Scopes

Each key carries scopes written `resource:action`. A route that needs a scope the key lacks answers `403 scope_missing`, and `detail` names the scope. `GET /v2/me` returns the scopes of the key you are using, and the [scope catalog](/basics/scopes) lists all of them.

Two scopes cost money or move data outside Lelemon, so they are separate:

- `cases:converse` writes as the contact, which runs the agent and spends model tokens.
- `actions:write` and `webhooks:write` decide where your conversation data goes.

## Acting on a subaccount

A platform key adds `Lelemon-Subaccount: sub_...` to any request. See [Run Lelemon for your customers](/guides/platforms).