> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://api.lemmy.be/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://api.lemmy.be/_mcp/server.

# Authentication

The Lemmy API authenticates requests with an **API key**. Every request must include your
key in the `x-api-key` header *and* an `x-company-id` header identifying your company.
Requests missing either are rejected.

## Getting an API key

You can generate your own API keys directly in In-Motion Online — no need to contact
support. Go to **Configuratie → Integraties → API Keys** and create a key. Each key is a
150-character string.

Treat your API key like a password: it grants access to your company's data. Store it
securely and never share it.

## Finding your company ID

Your company ID is the `companyid` used throughout In-Motion Online. When you're logged in,
look at the URL in your browser — every link includes it as a parameter:

```
https://app.inmotionsoftware.be/...?companyid=1234
```

In the example above, your company ID is `1234`. Send it as the `x-company-id` header on
every API request.

## Authenticating a request

Send two headers on every request:

| Header         | Description                 | Example              |
| -------------- | --------------------------- | -------------------- |
| `x-api-key`    | Your 150-character API key. | `x-api-key: a1b2c3…` |
| `x-company-id` | Your company ID (integer).  | `x-company-id: 1234` |

```bash
curl https://app.inmotionsoftware.be/Lemmy_API_IS/rest/v1/GetCustomers \
  -H "x-api-key: your-api-key" \
  -H "x-company-id: 1234"
```

## Failed authentication

A missing or invalid API key returns `401 Unauthorized`. After **5 failed attempts**, the
key is temporarily blacklisted, and if failed attempts keep happening your **IP address**
may be blacklisted as well. If you find you're blocked, contact the
[Lemmy service desk](mailto:support@lemmy.be) to get unblocked.

## Good practice

* **Always use HTTPS.** The API is only available over `https://` — never send your API key over plain HTTP.
* **Keep your API key server-side.** Don't embed it in browser, mobile, or other client-side code where users could extract it.
* **Store it as a secret.** Use environment variables or a secrets manager rather than hard-coding it.

If you believe your API key has been exposed, generate a new one in In-Motion Online under
**Configuratie → Integraties → API Keys** and stop using the old one.