Providers / Lemon Squeezy

Payments

Lemon Squeezy API keys and credentials

What every Lemon Squeezy credential a founder holds does, whether it expires, and what tends to break. Each fact links to Lemon Squeezy's own docs.

Last checked 2026-11-08 · www.lemonsqueezy.com

At a glance

Each credential

Lemon Squeezy dashboard login

• Not documented

Dashboard account login. Session and password or 2FA policy not documented on the pages reviewed. Store-level team access is managed in the dashboard.

Lemon Squeezy docs

API key (Settings > API)

• Doesn't expire

Each key is named at creation (name cannot be changed later) and shown only once. Keys are created in test mode or live mode; test-mode keys only touch test-mode data. No expiry is documented, so treat as non-expiring until revoked, but expiry is not confirmed. Rotate by creating a new key and deleting the old one in Settings > API. Rate limit is 300 calls per minute. Scoping is not documented.

Lemon Squeezy docs

Webhook signing secret

• Not documented
• Full access only

Entered by the founder when creating a webhook; the docs say it is normally a random string of 6 to 40 characters. Lemon Squeezy sends an HMAC hex digest in the X-Signature header computed over the raw body. The docs do not describe expiry, rotation, or how to update the secret after creation.

Lemon Squeezy docs

What usually goes wrong

• API key is pasted into client-side code or committed to a repository, exposing store-level access
• Webhook signing secret is changed or lost after creation and signature verification starts failing silently
• Webhook handler rejects payloads because it hashes a re-serialized body instead of the raw request body
• Lost API key cannot be recovered because it is displayed only once, forcing an immediate replacement in production
• Test-mode key used in production, so live orders never reach the app

Renewals and billing

Subscription invoices (GET /v1/subscription-invoices) return totals, tax, refunds and dates per invoice (amounts in cents, USD and invoice currency). Fee fields are not listed in that object. Fetched docs do not show filter parameters for dates.

What Lemon Squeezy's docs don't say

We couldn't confirm these from official docs, so don't rely on them either way:

• Whether API keys support scopes or permissions
• Whether webhook signing secrets can be updated after creation
• Exact current transaction fee and payout fee schedule
• Dashboard login session lifetime and 2FA policy
• Whether usage or spend data is available through the API
• Whether API keys have any scope or read-only option (none documented)
• Date filter parameters for subscription-invoices (not on the fetched page)
• Whether the 300 calls per minute limit is current
• Keys valid for a year (stated on requests page) versus the earlier note that keys never expire; reconcile

Rotating or replacing a Lemon Squeezy key

The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:

Sources

• docs.lemonsqueezy.com/guides/developer-guide/getting-started
• docs.lemonsqueezy.com/api
• docs.lemonsqueezy.com/api/webhooks
• docs.lemonsqueezy.com/help/webhooks/signing-requests
• docs.lemonsqueezy.com/help/getting-started/getting-paid
• docs.lemonsqueezy.com/api/getting-started/requests
• docs.lemonsqueezy.com/api/subscription-invoices

Related providers

Keep track of every Lemon Squeezy key

StackHangar stores your Lemon Squeezy keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.