Linkpeek Authentication

generated: '2026-08-09'
method: searched
source: openapi/linkpeek-openapi-original.yml
docs: https://147.15.103.217.sslip.io/openapi.yaml
docs_additional:
  - https://github.com/dcn13l/hermes-autonomia
  - https://147.15.103.217.sslip.io/api/pricing
summary:
  types:
  - apiKey
  api_key_in:
  - query
  anonymous_tier: true
  oauth2_flows: []
schemes:
- name: ApiKeyAuth
  type: apiKey
  in: query
  parameter: key
  required: false
  key_prefix: lp_pro_
  description: |-
    Optional API key for Trial/Pro tiers (lifts daily quota to 50,000).
    Obtain via `/api/key?email=` (free 14-day trial) or
    `/api/subscribe?email=` (Pro, $1/mo). Free tier requires no key.
  sources:
  - openapi/linkpeek-openapi-original.yml
anonymous_access:
  supported: true
  metering: per-source-ip
  daily_limit: 100
  note: >-
    The spec's top-level `security` is `[{}, {ApiKeyAuth: []}]` — the empty requirement makes
    anonymous access a first-class, declared mode rather than an accident. There is no signup.
key_issuance:
  trial: 'GET /api/key?email=<address> — 14-day key, no card, auto-expires to Free'
  pro: 'GET /api/subscribe?email=<address> — non-expiring key plus a PayPal payment link, $1/month'
  validation: 'GET /api/validate-key?key=<key> (live route; not in the published OpenAPI)'
  self_serve: true
  note: >-
    Both issuance operations are side-effecting `GET` requests with no idempotency contract — see
    conventions/linkpeek-conventions.yml.
weaknesses:
  - >-
    The key is carried on the query string, so it is exposed to proxy logs, browser history and
    referrer headers. The spec documents no header alternative, although the live CORS policy
    advertises `X-API-Key` as an allowed request header.
  - >-
    No 401 or 403 response is documented for any operation, so an invalid or expired key has no
    published contract.
  - No scopes, no permissions model, no token expiry semantics beyond the 14-day trial window.
  - No OAuth 2.0, no OIDC, no mTLS. /.well-known/openid-configuration and /.well-known/oauth-authorization-server both returned 404.