Getting started

Authentication

API keys for test and live data, rate limits and handling keys safely.

Every request to /v1 and to the MCP server needs an API key in the Authorization header:

GET /v1/organization HTTP/1.1
Host: api.ladehase.com
Authorization: Bearer lh_live_…

Test and live keys

Prefix	Data	Payments	Charging stations
`lh_test_`	Test data (`livemode: false`)	Test payments, no real money	Simulated test devices
`lh_live_`	Live data (`livemode: true`)	Real payments via zahls.ch or Freika	Your connected charging stations

Test and live data are fully separated. A test key never sees live data and vice versa.

Create keys in the dashboard under «Developers» and give them a name so you recognise them later. The full key is shown only once. Store it in a password manager or in your application's environment variables.

Treat live keys like passwords. Never put them in source code, front ends or public repositories. If a key is compromised, revoke it immediately in the dashboard.

Rate limit

Each key has a per-minute limit (600 requests by default). Every response contains the headers RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset. If you exceed the limit, the API responds with 429 and the code rate_limited. The Retry-After header tells you how many seconds to wait.

Organisations

A key always belongs to exactly one organisation. If you work for several organisations (for example as an installer), create one key per organisation.

Authentication errors

Status	Code	Meaning
401	`unauthorized`	Key is missing, invalid or revoked.
403	`forbidden`	The key may not perform this action or the feature is not enabled for the organisation.

Found a mistake? Write to developer@ladehase.com.