Authentication
Two credentials, two different places they're allowed to live.
1. Your fleet's API key (server-side only)
LotGrids issues one API key per fleet, shown once in your Partner Dashboard's API Access tab. It looks like this:
lg_live_<fleetId>.<64-character secret>
Send it as a header on requests to Mint Driver Token only:
Authorization: ApiKey lg_live_f_8f21a9.9c2e...
Never embed this key in a driver-facing app, mobile binary, or any client-side code. It must only ever be called from your own backend. If you suspect it has leaked, regenerate it immediately from the Partner Dashboard — the previous key stops working the instant you do.
2. The driver token (server or driver app)
Your backend exchanges the API key for a driver token, scoped to exactly one driver's email, by calling Mint Driver Token. Hand that token to the driver's app session — it's what authenticates every subsequent call:
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
The token expires 30 minutes after it's minted. It is not single-use — a driver app can call Quote and then Start with the same token as long as it's still valid. There is no refresh flow: once expired, just have your backend mint a new one (the API key itself doesn't expire, only rotates when you regenerate it).
A driver token can only ever act on the driver email it was minted for. If a request's driverEmail doesn't match the token's scope, the call fails with token_scope_mismatch — one driver's token can never touch another driver's wallet, even by accident.
| Credential | Header | Used by | Lifetime |
|---|---|---|---|
| API key | Authorization: ApiKey <key> | Your backend, for Mint Driver Token only | Until you regenerate it |
| Driver token | Authorization: Bearer <token> | Your driver app, for Quote/Start | 30 minutes |