Authentication

The Lemmy API authenticates requests with an API key. Every request must include your key in the x-api-key header and an x-company-id header identifying your company. Requests missing either are rejected.

Getting an API key

You can generate your own API keys directly in In-Motion Online — no need to contact support. Go to Configuratie → Integraties → API Keys and create a key. Each key is a 150-character string.

Treat your API key like a password: it grants access to your company’s data. Store it securely and never share it.

Finding your company ID

Your company ID is the companyid used throughout In-Motion Online. When you’re logged in, look at the URL in your browser — every link includes it as a parameter:

https://app.inmotionsoftware.be/...?companyid=1234

In the example above, your company ID is 1234. Send it as the x-company-id header on every API request.

Authenticating a request

Send two headers on every request:

$
curl https://app.inmotionsoftware.be/Lemmy_API_IS/rest/v1/GetCustomers \
>
  -H "x-api-key: your-api-key" \
>
  -H "x-company-id: 1234"

Failed authentication

A missing or invalid API key returns 401 Unauthorized. After 5 failed attempts, the key is temporarily blacklisted, and if failed attempts keep happening your IP address may be blacklisted as well. If you find you’re blocked, contact the Lemmy service desk to get unblocked.

Good practice

• Always use HTTPS. The API is only available over https:// — never send your API key over plain HTTP.
• Keep your API key server-side. Don’t embed it in browser, mobile, or other client-side code where users could extract it.
• Store it as a secret. Use environment variables or a secrets manager rather than hard-coding it.