> ## Documentation Index
> Fetch the complete documentation index at: https://docs.layarva.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate Queue API Requests

> Use Queue-scoped Bearer credentials, mutation replay protection, idempotency, and correlation IDs.

## Credential boundary

A Queue API credential belongs to exactly one Queue Unit and can be restricted by operation scope, Location, and service Category. It cannot access another Queue Unit.

Use the secret only from a trusted server:

```http theme={null}
Authorization: Bearer lvq_live_example
```

## Mutation replay protection

`POST /tickets` additionally requires:

```http theme={null}
X-Request-Timestamp: 2026-08-23T15:02:31Z
X-Request-Nonce: 2b37c82c-b87d-4f60-8a06-930d2d858d96
Idempotency-Key: ef89fac1-6ca8-4d8a-8810-fcd2f64df35f
```

* Timestamp must be within five minutes of Platform time.
* Nonce must be unique, 12–160 characters, and is remembered for ten minutes.
* Idempotency Key is required and at most 160 characters.
* Request body is limited to 16 KB.

GET endpoints require the Bearer credential. Supplying fresh timestamp and nonce headers consistently is recommended for client uniformity, but mutation replay enforcement is applied to `POST /tickets`.

## Correlation ID

Optionally send `X-Correlation-ID` using 1–120 letters, digits, `_`, `.`, `:`, or `-`. Layarva generates one when the supplied value is absent or invalid.

## Secret handling

* Store the key in a server-side secret manager.
* Never embed it in a browser, Kiosk theme, Studio Design, or screenshot.
* Rotate or revoke the credential immediately after suspected exposure.
* Branch on stable error codes; do not parse human-readable messages.

## Related guides

* [Configure the Queue External API](/queue/external-api)
* [Queue API Quickstart](/developers/queue-api)
* [Security Overview](/security/overview)