API key

An API key is your backend's secret for talking to Livqeno. It's the only thing that can create rooms, conversations, and tokens. Treat it like a database password.

In the overall flow, the key is step two:

Project → API key → your backend mints a token → your app joins → webhooks.

You need a project before you can create a key.

What a key looks like

The dev part is only a label for you. Livqeno checks the environment saved with the key, not the label. See API keys.

Why it matters

• Only an API key can make tokens. Apps can't. So your backend, which knows who is logged in, decides who the user is and what they may do.
• It ties every request to one project and one environment. You never pass those in the request.
• You can revoke each key on its own. Revoking one key doesn't affect others, and every call made with it is logged.

When to create a key

• One key per backend per environment. For example, backend in development and backend in production.
• A separate key per service if you have more than one backend service (say, an API server and a worker). Then you can revoke one without breaking the other.
• A new key when you rotate: create the new one, deploy it, then revoke the old one.

Where to keep it

In your backend's secret storage (environment variables on your server, or your cloud's secret manager). Never in:

• a frontend bundle
• a mobile app
• a git commit

Anyone who can read your app's code can read anything inside it. Your app gets a token instead.

Both server SDKs need the key passed in directly. They don't read environment variables on their own, so a production key can't slip into a development process by accident.

Example

On your backend (TypeScript), create the server SDK client once, when your server starts. Every call it makes uses this key:

import { Livqeno } from '@livqeno/server';
 
const livqeno = new Livqeno({
  apiKey: process.env.LIVQENO_API_KEY!,
  baseUrl: process.env.LIVQENO_API_URL!, // https://api.livqeno.com
});

Next steps

1. Token: what your backend makes with this key, and what your app gets instead.
2. API credentials: create, rotate, and revoke keys.
3. API keys: storage, and what a leak exposes.