{"article":{"id":10575849523735,"url":"https://linksquares.zendesk.com/api/v2/help_center/en-us/articles/10575849523735.json","html_url":"https://help.linksquares.com/hc/en-us/articles/10575849523735-Managing-API-Keys-and-Authenticating-to-the-LinkSquares-APIs","author_id":9550772382103,"comments_disabled":true,"draft":false,"promoted":false,"position":3,"vote_sum":0,"vote_count":0,"upvote_count":0,"downvote_count":0,"section_id":26436087990551,"created_at":"2022-11-29T19:53:33Z","updated_at":"2026-02-24T17:37:04Z","name":"Managing API Keys and Authenticating to the LinkSquares APIs","title":"Managing API Keys and Authenticating to the LinkSquares APIs","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2025-09-02T17:47:42Z","user_segment_id":null,"permission_group_id":1091514,"content_tag_ids":[],"label_names":["API","API Key Management","API Key","api"],"body":"<h2 id=\"h_01HBY9J9ZDTXH7TRC7JR3AGPBK\"><span style=\"font-weight: 400;\">Overview </span></h2>\n<p><span style=\"font-weight: 400;\">LinkSquares APIs are secured from unauthorized use by restricting calls to those that provide proper authentication credentials. The credentials are in the form of an API Key, which is a unique alphanumeric string that the system uses to identify your company’s data.</span></p>\n<p><span style=\"font-weight: 400;\">These keys should be stored in a password manager or an alternative safe location since having access to them is the equivalent of access to your agreements.</span></p>\n<p><span style=\"font-weight: 400;\">Note: LinkSquares API Tokens are shared across Analyze and Finalize. The same token can interact with either application. </span></p>\n<h2 id=\"h_01HBY9J9ZDMR7GVCFTA5J0F74W\"><span style=\"font-weight: 400;\">Authentication</span></h2>\n<p><span style=\"font-weight: 400;\">LinkSquares APIs utilize a common API key-based authentication, which is invoked by embedding the API key in the request header. API endpoints are REST/HTTPS unless otherwise specified, with request and response data in JSON format.</span><span style=\"font-weight: 400;\"></span></p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Each API key is tied to a user and company.</span></li>\n<li style=\"font-weight: 400;\" aria-level=\"1\">\n<span style=\"font-weight: 400;\">Best practice is to use a service account vs. a user account (Example: </span><a href=\"mailto:linksquares_api@companydomain.com\"><span style=\"font-weight: 400;\">linksquares_api@companydomain.com</span></a><span style=\"font-weight: 400;\">)</span>\n</li>\n<li style=\"font-weight: 400;\" aria-level=\"1\">The API user <strong>must</strong> be configured as an Analyze or Finalize Administrator. The IT Administrator role cannot be used for the User account that manages the API key.</li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The API Key must be included as an x-api-key Header to every API request.</span></li>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"2\"><span style=\"font-weight: 400;\">Value = x-api-key</span></li>\n<li style=\"font-weight: 400;\" aria-level=\"2\">\n<span style=\"font-weight: 400;\">The API Gateway uses JWT (JSON Web tokens) as additional security to securely transmit information between systems</span><span style=\"font-weight: 400;\"></span>\n</li>\n</ul>\n</ul>\n<h3 id=\"h_01J80K399P6P3AYYAZH0DHCDAM\">Authentication Examples</h3>\n<p>Adding your API key should be quick and easy. Here is a quick cURL example from which you can build.  Swap out XXXXX for your API key.</p>\n<pre>curl --location 'https://api.linksquares.com/api/analyze/v1/agreements' \\<br>--header 'Content-Type: application/json' \\<br>--header 'x-api-key: XXXXX'</pre>\n<p>If you're working in Postman, this will often look like the below, again, swap out the XXXXX for your key:</p>\n<p><img src=\"https://help.linksquares.com/hc/article_attachments/26436773009815\"></p>\n<h3 id=\"h_01HBY9J9ZDVRY2VD1GARN579QA\">Creating an API Key </h3>\n<p><span style=\"font-weight: 400;\">LinkSquares Administrators can create API keys in the LinkSquares web app settings. </span></p>\n<p><span style=\"font-weight: 400;\">To begin, go to <strong>Settings </strong>from the app selector.</span></p>\n<p><span style=\"font-weight: 400;\">Select <strong>API Keys.</strong></span></p>\n<p><span style=\"font-weight: 400;\">To create an API key, press the <strong>GENERATE API KEY</strong> button.</span></p>\n<p><span style=\"font-weight: 400;\"><img src=\"https://help.linksquares.com/hc/article_attachments/10575774294935\" alt=\"Generate_API_Key.png\"></span></p>\n<h3 id=\"h_01HBY9J9ZD0DWQY9P7DWM4PJPW\">Disabling an API Key </h3>\n<p><span style=\"font-weight: 400;\">If you ever wish to disable the API key (e.g., it was on a laptop that was lost or stolen), you can log in to LinkSquares and disable the key. </span><span style=\"font-weight: 400;\"></span></p>\n<p><span style=\"font-weight: 400;\">Once you disable the compromised key, you can create another one. In other cases, your security policy may dictate that API keys are rotated every 90 or 120 days. The process is the same. Once the option to disable a key is selected, please allow up to five minutes for the change to go into effect.</span><span style=\"font-weight: 400;\"></span></p>\n<p><span style=\"font-weight: 400;\">For the relevant API key, click the <strong>Enabled </strong>toggle. </span></p>\n<p><span style=\"font-weight: 400;\"><img src=\"https://help.linksquares.com/hc/article_attachments/10575811806999\" alt=\"Enabled_Toggle.png\"></span></p>\n<p><span style=\"font-weight: 400;\">The <strong>Disable API Key</strong> modal will appear and prompt you to confirm. Click <strong>SAVE</strong>.</span></p>\n<p><span style=\"font-weight: 400;\"><img src=\"https://help.linksquares.com/hc/article_attachments/10575814174103\" alt=\"Disable_Key_Pop_Up.png\"></span></p>\n<p><span style=\"font-weight: 400;\">The API key is now shown as <strong>Disabled</strong>. </span></p>\n<p><img src=\"https://help.linksquares.com/hc/article_attachments/10575994328215\" alt=\"Disabled_Toggle.png\"></p>\n<p><span style=\"font-weight: 400;\">Disabled keys can be re-enabled by clicking the same toggle.</span></p>\n<h3 id=\"h_01HBY9J9ZD3WP29Y029V767MW6\">Deleting an API Key </h3>\n<p><span style=\"font-weight: 400;\">If you no longer need an API key, it can be deleted by clicking the trash icon. </span></p>\n<p><span style=\"font-weight: 400;\"><img src=\"https://help.linksquares.com/hc/article_attachments/10575818842391\" alt=\"Delete_Icon.png\"></span></p>\n<p><span style=\"font-weight: 400;\">The <strong>Delete API Key </strong>modal will appear and prompt you to confirm. Click <strong>DELETE</strong>.</span></p>\n<p><span style=\"font-weight: 400;\"><img src=\"https://help.linksquares.com/hc/article_attachments/10575870577559\" alt=\"Delete_API_Key_Pop-Up.png\"></span></p>\n<p><span style=\"font-weight: 400;\">There is no way to undo the deletion of a key. Once deleted, please allow up to five minutes for the change to go into effect.</span><span style=\"font-weight: 400;\"><br></span></p>\n<h3 id=\"h_01HBY9J9ZDPTH8ES0K78SC0T71\">Using HTTPS for the API Gateway <span style=\"font-weight: 400;\"></span>\n</h3>\n<p><span style=\"font-weight: 400;\">The API Gateway requires using HTTPS as a method of ensuring encryption and security of the public API. If HTTP is used then the user will receive a message detailing that a connection was not able to be established.</span></p>"}}