Partner API keys

A partner API key is a bearer credential for one client of one organisation. Send it on every request; nothing else is needed.

Fact	Value
Format	Begins `lap_`
Header	`Authorization: Bearer <key>`
Shown	Once, when issued. Afterwards only its last four characters are listed
Stored by Advisor	A hash of the key, never the key
Lifetime	90 days
Active keys per client	At most two, so a key can be rotated without a gap

Sending the key

Read the key from an environment variable or a secret manager, never from a file in source control. Every example on this site reads LAWATLAS_API_KEY. See Connect a client for each client's configuration.

Counting your own users

A partner serving many end users may send X-LawAtlas-Subject with a one-way hash of its own user identifier, up to 128 characters. Advisor records it with the call as given, without reading it, so usage can be counted per seat. Never send a name, email address or other personal information in it.

What is checked on every call

Each check can only refuse; none grants more than the owning subscriber has.

Check	If it fails
The key is known, active, not expired and issued for this environment	HTTP 401
The organisation and the client are active	HTTP 401
The owner's AI Pro subscription is active	`FORBIDDEN`: keys are paused
The caller's address is in the client's allowlist, if one is set	`FORBIDDEN`
The client holds the scope the tool needs	`INSUFFICIENT_SCOPE`
Hansard tools: the current Hansard conditions are accepted	`TERMS_REQUIRED`
The client is within its rate limit	`RATE_LIMITED`

The scopes are legislation:read, graph:read, hansard:read and gazette:read; each tool page names the one it needs, and the tools index lists them all. renew_subscription refuses partner keys: a partner renews through the subscriber that owns it.

Rotating and revoking

Rotate issues a replacement. The old key keeps working for 24 hours, then stops.
Revoke stops a key within a minute, including on a connection that is already open.

Expiry

Keys last 90 days. The partner page shows a banner 14 days before a key expires, and health returns partner_key.expires_at and days_to_expiry, so your own systems can warn you. No expiry emails are sent.