Leamout supports two authentication paths for customer-facing HTTP routes.
Organization credentials
Server-to-server API clients should use an organization credential:
Organization credentials are opaque high-entropy tokens. A generated token begins with lm_org_; Leamout stores only a hash and a short non-secret lookup prefix. The plaintext token is returned only when the credential is created.
Each credential belongs to one organization and has explicit scopes. Organization-scoped API middleware maps HTTP reads to <resource>:read and mutations to <resource>:write.
Examples include:
A bearer credential supplies its own organization context. Do not send X-Organization-ID with it to switch tenants; a credential cannot be used to cross its organization boundary.
Session authentication
The hosted/customer UI uses a session cookie. Session-authenticated organization routes use:
Leamout checks that the signed-in user is a member of the requested organization. Member roles also affect write access: ordinary members are read-only for organization-scoped resource mutations, while deleting an organization is owner-only.
Which should I use?
Use an organization credential for applications, backend services, automation, and API integrations. Use a session for interactive user flows such as organization, membership, and API-credential management.
Never log organization credentials, session cookies, SIP passwords, carrier secrets, webhook signing secrets, TURN credentials, or TLS private keys.
