Authentication

One API token works everywhere: the MCP server for AI tools and the REST API for scripts and apps. It resolves to your Lemon Domains account and only ever touches your own data.

API tokens

Create a token on the MCP page or the API page in your account. Both pages share one list of tokens. Send the token on every request:

code

Authorization: Bearer lemd_xxxxxxxxxxxxxxxx

Shown once. Only a SHA-256 hash is stored; the raw value can't be recovered. Generate a new one if you lose it.
Prefix. Tokens start with lemd_; the dashboard shows the prefix so you can tell them apart.
Access. Read and write (default) or read-only. A read-only token can call the list and get tools; tools that add, change or delete data return "This token is read-only".
Expiry. Optional: 30 days, 90 days, 1 year, or never.
Revocable. Revoke any time; the next request returns 401 immediately.

Treat a token like a password. A read and write token can change or delete anything in your portfolio. Prefer read-only or short-lived tokens where you can.

How your data is scoped

Every tool only reads or writes data owned by your account.
Project roles are enforced: viewers can read but not write; some actions are owner-only.
Registrar API keys and secrets are never exposed via MCP or the API.
Use a separate token for each tool or script, so you can see when each was last used and revoke one without touching the others.

← Quickstart Connect a client