API credentials

An API key is how your backend proves to Livqeno that a request comes from you. Your backend uses it for one main job: making tokens for your users. Because it can do anything in its environment, treat it like a database password. Keep it on your server only.

Where this fits: project → API key → your backend makes tokens → your app joins. You need a project first.

Create a key

Make one key per environment your backend runs in. For example, a development key for your laptop and a production key for your live server. That way local testing can never touch real users' data.

Create it in the dashboard, or with the CLI on your computer:

livqeno projects use <project-id>   # once, if you haven't selected a project yet
livqeno keys create --name backend --environment development

You'll see the key only once:

Copy it now and save it as LIVQENO_API_KEY in your backend's secrets. Livqeno can't show it again. If you lose it, create a new one.

What's inside a key

rvk_dev_8Kd2nQxwYtLm.aG9wZXlvdWFyZWhhdmluZ2Fsb3ZlbHlkYXk
└─┬─┘└┬┘└─────┬─────┘ └────────────────┬────────────────┘
  │   │       │                        │
  │   │       └ public id              └ secret part
  │   └ environment label (just for you to read)
  └ prefix

The public id identifies the key; the secret part proves you own it. Livqeno stores only a hash of the secret, which is why it can't show the key again.

Each key is tied to one environment on our side. A development key can never touch production data, whatever a request asks for. The dev label is only a hint so you can tell keys apart; changing it does nothing.

Use the key

Your backend needs two values, usually stored as environment variables or in your secrets manager:

LIVQENO_API_KEY=rvk_dev_...
LIVQENO_API_URL=https://api.livqeno.com

Add .env to your .gitignore. In production, set the same two names in your host's secrets settings instead of shipping a file.

On your backend, pass both to the server SDK yourself. It does not read environment variables on its own. This is deliberate: it means a production key sitting in your shell can't sneak into a dev process.

Create the client once, when your server starts, and reuse it for every request:

import { Livqeno } from '@livqeno/server';
 
const livqeno = new Livqeno({
  apiKey: process.env.LIVQENO_API_KEY!,
  baseUrl: process.env.LIVQENO_API_URL!, // https://api.livqeno.com
});

import os
from livqeno import Livqeno
 
livqeno = Livqeno(
    api_key=os.environ["LIVQENO_API_KEY"],
    base_url=os.environ["LIVQENO_API_URL"],  # https://api.livqeno.com
)

client := livqeno.New(
	os.Getenv("LIVQENO_API_KEY"),
	livqeno.WithBaseURL(os.Getenv("LIVQENO_API_URL")), // https://api.livqeno.com
)

import com.livqeno.server.Livqeno;
 
Livqeno livqeno = Livqeno.builder()
        .apiKey(System.getenv("LIVQENO_API_KEY"))
        .baseUrl(System.getenv("LIVQENO_API_URL"))   // https://api.livqeno.com
        .build();

$client = new \Livqeno\Client(
    apiKey: getenv('LIVQENO_API_KEY'),
    baseUrl: getenv('LIVQENO_API_URL'), // https://api.livqeno.com
);

curl "$LIVQENO_API_URL/v1/rooms" \
  -H "Authorization: Bearer $LIVQENO_API_KEY"

Change or remove a key

Revoke a key when it may have leaked, when someone who had it leaves, or as regular hygiene. On your computer:

livqeno keys list
livqeno keys revoke <keyId>

To rotate a key safely:

Doing it in this order means your app never goes down: the new key works before the old one stops.

Tokens made by a revoked key keep working until they expire. Since tokens are short-lived, this window is small.

Never put the key in your app

Anything shipped to a user's device can be read by that user. A key inside a browser bundle, a mobile app, or a git commit is public, and anyone who finds it could create rooms, read messages, and use up your allowances.

Your app gets a token instead. A token is short-lived and only works for one room or conversation. See Mint a token.

Read Security before going live.

Common mistakes

Next steps

Your backend can now talk to Livqeno. Next: