Legnext uses an API key in the x-api-key request header.
Create and manage keys in the
Legnext dashboard, then store the key in your
application’s server-side secret or environment configuration.
Never expose a Legnext API key in browser or mobile client code, public logs,
agent conversations, or committed .env files. Send requests through a trusted
server boundary.
Request base URL
Use this base URL for the API:
Endpoint paths in the API Reference are appended to that base. For example,
POST /v1/diffusion becomes:
Get Task is the exception
GET /v1/job/{job_id} does not require an API key. The UUID in that URL is a
capability token: anyone who has it can read the public task result.
Keep each job_id server-side. Do not expose it in browser URLs, client logs,
analytics events, screenshots, or support messages sent through public
channels.
Authentication failures
An absent, invalid, revoked, or wrong-environment key returns 401. A disabled
account returns 403. Do not retry either response unchanged; correct the key or
account state first.
See Errors & Handling for the client action associated
with each failure class. 
