# Account API

The versioned account API provides read-only access to the signed-in customer's existing proxy-token metadata and usage.

## Available operations

Base URL:

```text
https://litport.net/api/v1
```

The initial version supports only:

- `GET /api/v1/tokens`
- `GET /api/v1/tokens/{tokenId}/usage`

There is no API endpoint to create, edit, disable, rotate, or delete proxy tokens.

## Authentication

Create an account API key on [Settings](/users/settings). Its full value remains available there after creation or rotation.

```bash
export LITPORT_API_KEY='lit_replace_with_your_key'
curl 'https://litport.net/api/v1/tokens' \
  -H "Authorization: Bearer $LITPORT_API_KEY"
```

External clients use the exact Bearer scheme. Do not send a key in the query string, JSON body, cookie, or proxy username. Store it as a secret, restrict access to server-side workloads, and rotate it if it may have leaked.

The **Run** controls on these documentation pages use your signed-in Litport account. If you are signed out, the control asks you to log in first.

## Credential boundaries

| Credential | Purpose |
| --- | --- |
| Proxy token username/password | Opens proxied data-plane connections. |
| Proxy token ID | Selects a proxy token in an authenticated account operation; not a secret. |
| User API key (`lit_…`) | Authenticates account control-plane requests. |

## Conventions

- Responses use JSON except for empty HTTP bodies.
- Time ranges are half-open: `from` is included and `to` is excluded.
- Timestamps must be canonical UTC ISO-8601 values ending in `Z`.
- Potentially large byte counters are decimal strings.
- Cursor values are opaque. Store and send the returned cursor unchanged; do not parse it.
- The default account API limit is 120 requests per 60-second window for each API key. Read `RateLimit-Limit`, `RateLimit-Remaining`, and `RateLimit-Reset`; a rejected request also includes `Retry-After`.
- `X-Request-ID` identifies the request for debugging.
- Authenticated responses use `Cache-Control: private, no-store` and `Vary: Authorization`.

## Machine contract

Use the [OpenAPI 3.1 document](/docs/openapi.json) for operation IDs, parameters, and schemas. Handle the [common error envelope](/docs/api/errors) before using individual endpoint data.