Authentication

How to authenticate API requests to First Leeward.

All API requests require authentication using an API key.

API Key

Include your API key as a Bearer token in the Authorization header:

Authorization: Bearer YOUR_API_KEY

API keys are project-scoped. Each key grants access to resources within a single project.

API Versioning

Include the Leeward-Version header in every request to specify which API version to use:

Leeward-Version: 2026-09-18

The version uses a date-based format (YYYY-MM-DD). Requests without this header will be rejected.

Example

curl https://api.firstleeward.com/v0/users \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Leeward-Version: 2026-09-18"

Environment

Environment	Base URL
Production	https://api.firstleeward.com/v0/

All requests are made against this single base URL.

IP allowlist

Each key can optionally be restricted to a list of IPv4/IPv6 addresses or CIDR ranges. An empty list means the key works from any IP.

When a list is set, requests from any other address are rejected with 403 and code API_KEY_IP_NOT_ALLOWED. First Leeward uses the last X-Forwarded-For hop (the address the load balancer saw). If that hop is missing, the request is also rejected.

Contact the First Leeward team to obtain API keys for your project.