API Authentication

Authenticate supported LastDatabase API requests using an active customer API key in the HTTP Authorization header.

Create an API Key

1. Sign in to your LastDatabase customer account.
2. Open API Management.
3. Make sure an appropriate API plan is active.
4. Create an API key and give it a descriptive application name.
5. Store the credential securely before using it in production.

Use separate keys when you want independent application-level visibility or easier credential revocation.

Bearer Authentication

Send the API key using the standard HTTP Authorization header:

Authorization: Bearer YOUR_API_KEY

For JSON POST requests, also send:

Accept: application/json
Content-Type: application/json

Example

curl -X GET \
  "https://lastdatabase.com/api/integrations/v1/credits" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json"

The server hashes the supplied Bearer token and resolves it against an active API key. Disabled keys are not accepted.

Authentication Errors

Missing API token

A request to a protected endpoint without a Bearer token returns HTTP 401.

{
  "status": false,
  "message": "Missing API token."
}

Invalid or disabled token

A token that does not match an active API key also returns HTTP 401.

{
  "status": false,
  "message": "Invalid API token."
}

Daily API Request Limits

Each authenticated API request increments the usage counter associated with the API key. Usage resets when the stored last-use date differs from the current server date.

When used_today reaches the key's daily_limit, the middleware returns HTTP 429.

{
  "status": false,
  "message": "Daily API limit exceeded."
}

Current API plans

Inspect current usage

GET /api/integrations/v1/credits

The Credits endpoint returns the authenticated key's daily limit, requests used today and remaining requests, together with remaining lead-subscription records.

Credential Security

• Store API keys in environment variables or a dedicated secret manager.
• Keep credentials server-side.
• Do not embed API keys in browser JavaScript.
• Do not publish keys in GitHub, GitLab or other source repositories.
• Do not include live credentials in documentation or screenshots.
• Use HTTPS for all requests.
• Restrict access to production environment variables.
• Disable unused or compromised keys promptly.

Environment-variable example

LASTDATABASE_API_KEY=your_private_api_key

Your application can read the secret at runtime rather than storing it directly in source code.

Key Rotation and Revocation

When replacing a credential, create a new key, update the authorized application, confirm the new key works, and then disable the old key. This reduces unnecessary downtime during planned rotation.

If a key is suspected of exposure, stop using it and disable it through API Management. Do not rely on hiding an exposed key in application code after it has already been disclosed.

Authentication Examples

PHP

$apiKey = getenv('LASTDATABASE_API_KEY');

$headers = [
    'Authorization: Bearer ' . $apiKey,
    'Accept: application/json',
];

Python

import os

headers = {
    "Authorization": f"Bearer {os.environ['LASTDATABASE_API_KEY']}",
    "Accept": "application/json",
}

Node.js

const headers = {
  Authorization: `Bearer ${process.env.LASTDATABASE_API_KEY}`,
  Accept: "application/json"
};

Continue with the API Search and Filtering guide or return to the complete API reference.