Authentication

LogirAI uses one authentication scheme for incoming requests, plus a second on webhook deliveries to your endpoint.

Scheme	Header	Used by
Company API password	Authorization: Bearer <api_password>	All endpoints under /api/public/pre-alerts/v1/*.
Webhook Bearer	Authorization: Bearer <secret>	Your endpoint receiving outbound webhooks from LogirAI.

The only unauthenticated endpoint is GET /health (liveness probe).

---

Company API password

Each company is provisioned with an api_password when onboarded. Pass it as a Bearer token on every request.

curl -X POST https://api.logirai.com/api/public/pre-alerts/v1/upload \
  -H "Authorization: Bearer YOUR_COMPANY_API_PASSWORD" \
  -F "manifest_file=@manifest_2026-04.xlsx" \
  -F "invoice_file=@invoice.pdf"

• The company is inferred from the token — no company_id form field is needed or accepted.
• One password, multiple countries. The same api_password ships pre-alerts to any country in your allowed_countries (CL/PE/AR). The country is derived from each manifest's destination — you do not send country. See process-pre-alert-json.
• One password per company. Rotation is manual — contact your LogirAI integration partner.
• The password authenticates the company, not an individual user. Treat it like a database credential: store in a secret manager, never in source code or client-side bundles.
• Server-side scope: every list and detail endpoint filters by the company that owns the token. You cannot see another company's data.

Failure modes

Response	Meaning
401 { error: "missing_api_key" }	Authorization header absent or not in Bearer <token> form.
401 { error: "invalid_api_key" }	Token does not match any provisioned api_password.
403 { error: "unsupported_country" }	Your company has no country served by this endpoint.
403 { error: "country_not_allowed" }	The country derived from the manifest destination is not in your allowed_countries. Ask ops to widen your allowlist.
404 { error: "not_found" }	Resource exists but doesn't belong to the company that owns the token, or doesn't exist at all.

---

Webhook Bearer (receiving events)

When LogirAI delivers a webhook to your endpoint, the request is authenticated with a Bearer token that you provided to us during onboarding. Verify it on every request before processing.

POST https://your-app.com/webhooks/logirai HTTP/1.1
Authorization: Bearer YOUR_WEBHOOK_SECRET
Content-Type: application/json
User-Agent: LogirAI-Webhook/1.0
X-Logir-Delivery-Id: evt_e37af6c2-9275-4dd1-9e94-d2726245d38c
X-Logir-Event: guide.delivered

• Compare the incoming Bearer to the secret you stored at onboarding — use a constant-time comparison to avoid timing attacks.
• Reject any request whose Bearer doesn't match with a 401.
• Rotate the secret by contacting LogirAI ops. Rotation is immediate; the next event uses the new secret with no grace period.

For full payload schemas and event catalog: Webhooks Overview.

---

CORS

LogirAI sets Access-Control-Allow-Origin: * and accepts the headers Content-Type and Authorization. Cookies and credentialed requests are not used.

Storage and rotation

Credential	Where it lives	Rotation
Company api_password	Server-side, on the companies row.	Manual via LogirAI ops.
Your webhook Bearer secret	Whatever secret store you control.	Coordinate rotation with LogirAI ops.

Never commit credentials

All examples on this site use placeholders (YOUR_COMPANY_API_PASSWORD, YOUR_WEBHOOK_SECRET). Treat real values like database passwords.

Diagnosing auth failures

Symptom	First thing to check
401 missing_api_key	The header isn't reaching us — check proxy stripping, header casing, and the Bearer prefix.
401 invalid_api_key	Token mismatch — confirm you're using the production token, not staging. Check for trailing whitespace or \n.
403 unsupported_country	Your company has no country served by this endpoint.
403 country_not_allowed	The manifest's destination resolves to a country outside your allowed_countries. Ask ops to add it.

Include the request timestamp (UTC) and the response body when escalating. LogirAI ops can correlate against server logs.