Manage your developer profile, API access, safe key metadata, and one-time API-key rotation.
Production practices for protecting your Lyren credentials
Place the key in a server-side environment variable or a managed secret store. Never commit it to GitHub.
Send Lyren API requests from a trusted backend. Browser code can expose secrets to users and third-party scripts.
Prepare the receiving application before rotation because the existing key is revoked immediately.
The complete API key is shown only once, immediately after creation or rotation. Copy it before reloading, closing, or leaving the dashboard. Afterward, Lyren displays only safe metadata such as the prefix, scopes, status, dates, and key ID.
No. Lyren stores a protected key hash for verification rather than retaining the raw developer credential. Create or rotate a key when the original secret is no longer available.
Rotation revokes the selected active key and creates a replacement. Software using the previous key will stop authenticating immediately, so be ready to install the new credential in your application.
Copy is enabled only while a newly created or rotated raw key is present in this page's temporary memory. It becomes unavailable after the page reloads, closes, or navigates away.
The dashboard can show the key label, safe prefix, status, scopes, internal key ID, creation date, expiration date, and last-used time without exposing the full secret.
Send the developer key in the
x-api-key request header from a trusted
server-side application.
Use a server-side environment variable or managed secret system. Do not place it in frontend JavaScript, localStorage, sessionStorage, source control, public logs, or screenshots.
Rotate it immediately, replace the old value in every authorized application, and review recent API usage for activity you do not recognize.