Lemlist Authentication

generated: '2026-08-13'
method: searched
source: https://developer.lemlist.com/api-reference/getting-started/authentication
docs:
- https://developer.lemlist.com/api-reference/getting-started/authentication
- https://developer.lemlist.com/api-reference/getting-started/multiple-accounts
- https://developer.lemlist.com/cli/authentication
- https://developer.lemlist.com/mcp/setup
probed:
- url: https://app.lemlist.com/.well-known/oauth-authorization-server
  status: 200
- url: https://app.lemlist.com/.well-known/openid-configuration
  status: 200
- url: https://app.lemlist.com/.well-known/oauth-protected-resource
  status: 200
- url: https://api.lemlist.com/.well-known/oauth-authorization-server
  status: 200
note: >-
  lemlist runs two distinct authentication models on two surfaces. The REST API at
  api.lemlist.com is API-key only, carried as HTTP Basic with an EMPTY username and
  the key as the password. The MCP server and the CLI additionally accept OAuth 2.1
  (authorization code + PKCE, with dynamic client registration), whose metadata is
  served anonymously from lemlist's own /.well-known/ endpoints. Bearer tokens are
  explicitly NOT accepted by the REST API — lemlist's own Agent Skill says so.
summary:
  types:
  - http
  - apiKey
  - oauth2
  - openIdConnect
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
  pkce: S256
  dynamic_client_registration: true
schemes:
- name: basicAuth
  type: http
  scheme: basic
  surface: REST API (https://api.lemlist.com/api)
  description: >-
    HTTP Basic. The login is always empty and the password is the lemlist API key —
    Authorization: Basic base64(":YOUR_API_KEY"). The leading colon is required.
  key_provisioning: 'app.lemlist.com > Settings > Team > Integrations > Generate'
  scoping: one API key resolves to exactly one lemlist team/account
  sources:
  - openapi/_original/lemlist-openapi-v2.json
  - https://developer.lemlist.com/api-reference/getting-started/authentication
- name: apiKeyHeader
  type: apiKey
  in: header
  parameter_name: X-API-Key
  surface: MCP server (https://app.lemlist.com/mcp)
  description: The same lemlist API key, passed as an X-API-Key header to the MCP
    endpoint instead of Basic auth.
  sources:
  - https://developer.lemlist.com/mcp/setup
- name: oauth2
  type: oauth2
  surface: MCP server + CLI
  description: >-
    OAuth 2.1 authorization-code flow with PKCE (S256) and dynamic client registration.
    The consent screen asks the user to pick a team, so one grant binds to one account.
    Access tokens last 1 hour, refresh tokens 30 days.
  issuer: https://app.lemlist.com
  authorization_endpoint: https://app.lemlist.com/oauth/authorize
  token_endpoint: https://app.lemlist.com/oauth/token
  revocation_endpoint: https://app.lemlist.com/oauth/revoke
  registration_endpoint: https://app.lemlist.com/oauth/register
  jwks_uri: https://app.lemlist.com/.well-known/jwks.json
  flows:
  - flow: authorizationCode
    grant_types:
    - authorization_code
    - refresh_token
    code_challenge_methods:
    - S256
  token_endpoint_auth_methods:
  - none
  - client_secret_post
  scopes: see scopes/lemlist-scopes.yml (14 published)
  sources:
  - https://app.lemlist.com/.well-known/oauth-authorization-server
- name: openIdConnect
  type: openIdConnect
  openIdConnectUrl: https://app.lemlist.com/.well-known/openid-configuration
  surface: MCP server + CLI
  description: >-
    OIDC discovery is served alongside the OAuth metadata. id_token signing RS256,
    subject type public, userinfo at https://app.lemlist.com/oauth/userinfo.
  sources:
  - https://app.lemlist.com/.well-known/openid-configuration
multi_account:
  supported: true
  model: one credential per team; agencies store one profile per client team
  docs: https://developer.lemlist.com/api-reference/getting-started/multiple-accounts
  cli_support: 'lemlist auth login <profile> / lemlist auth use <profile> / --account
    <name> / LEMLIST_PROFILE'
errors:
  '401': Unauthorized — authentication is missing or invalid
  '403': Forbidden — user is blocked
  '400': Bad Request — includes "Bad team", an invalid or inaccessible team for this
    key