Authenticate Queue API Requests - Layarva Documentation

Credential boundary

A Queue API credential belongs to exactly one Queue Unit and can be restricted by operation scope, Location, and service Category. It cannot access another Queue Unit. Use the secret only from a trusted server:

Authorization: Bearer lvq_live_example

Mutation replay protection

POST /tickets additionally requires:

X-Request-Timestamp: 2026-08-23T15:02:31Z
X-Request-Nonce: 2b37c82c-b87d-4f60-8a06-930d2d858d96
Idempotency-Key: ef89fac1-6ca8-4d8a-8810-fcd2f64df35f

Timestamp must be within five minutes of Platform time.
Nonce must be unique, 12–160 characters, and is remembered for ten minutes.
Idempotency Key is required and at most 160 characters.
Request body is limited to 16 KB.

GET endpoints require the Bearer credential. Supplying fresh timestamp and nonce headers consistently is recommended for client uniformity, but mutation replay enforcement is applied to POST /tickets.

Correlation ID

Optionally send X-Correlation-ID using 1–120 letters, digits, _, ., :, or -. Layarva generates one when the supplied value is absent or invalid.

Secret handling

Store the key in a server-side secret manager.
Never embed it in a browser, Kiosk theme, Studio Design, or screenshot.
Rotate or revoke the credential immediately after suspected exposure.
Branch on stable error codes; do not parse human-readable messages.

⌘I