Authentication

How Lynx authenticates requests — session token, publishable key, the org_id requirement and roles.

The Lynx API — invoicing or data — carries two headers on every request:

Header	Value
Authorization	Bearer <access_token> — the session token of a signed-in user.
apikey	The deployment’s publishable key.

You obtain the session token by signing in to Lynx (Google or Microsoft account, or email and password). It is short-lived; refresh it through the session flow rather than storing it.

org_id is required

Every invoicing operation needs org_id in the body. A request without it is rejected with 400. The token must belong to a member of that organization.

Roles

• The /integrations/* operations (credentials for invoicing providers) require the admin role.
• The rest of the invoicing operations require admin or operador.
• Data reads over the lynx schema are limited by row-level security (RLS): you only see what your session is allowed to see.