Lemon Squeezy

Explore authentication, permissions and available actionsExact inputs, sign-in scopes, access limits and approval rules.

• Status: Needs setup. It works once you've made the key under Make the key.
• Connects through: a custom API connection to https://api.lemonsqueezy.com/v1.
• Category: Payments & banking

What hires can doCopy Anchor Link

Orders, subscriptions, customers and license keys.

Hires work with Lemon Squeezy's API through Roster, under the address you give and only on the paths you allow. Without an OpenAPI document they get two tools: one to read (GET) and one to send (POST, PUT, PATCH or DELETE). With a document, they get one tool per operation in it, each marked as reading or changing things.

Make the keyCopy Anchor Link

1. Click Open Lemon Squeezy's key page on the form, or open it here: app.lemonsqueezy.com.
2. Click the + next to API keys, name it Roster, and copy the key (it's shown once).
3. Paste it on the form. When you connect, Roster checks it with Lemon Squeezy and shows whose account it is.

Connect itCopy Anchor Link

1. Open Integrations → Tools → Add a tool, search for Lemon Squeezy and choose it.
2. Base address: filled in as https://api.lemonsqueezy.com/v1. Change it if yours is different.
3. How it signs in: Bearer token is chosen for you. Paste the key you made.
4. Click Connect, then Test connection. Untick any tool no hire should use, and click Save tools.

More about these fields in Custom APIs.

Choose what each hire may doCopy Anchor Link

Connecting Lemon Squeezy gives it to no one. On a hire's Tools tab, click Give access on the connection:

• Read only: only GET requests, or the operations in the document that only read.
• Read and write: every tool you saved on the connection.
• Tools: if you like, only some of them for this hire.
• Paths: path prefixes this hire may call, like /invoices. Leave empty for the whole API. Anything else is refused.

See Adding a tool.

When it asks firstCopy Anchor Link

On the connection, Ask before using starts at Tools that change things: every call to a tool that changes something waits for a person's approval in chat, and Roster makes exactly that call, once, when it's approved. Tools that only read never ask. Once you trust your hires with Lemon Squeezy, you can change it to Only tools a hire is set to ask about.

To change it for one hire, or for single tools, use When it asks first on the hire's Tools tab (more).

Personal dataCopy Anchor Link

Lemon Squeezy holds personal data about your customers and their payments. Hires see what Lemon Squeezy's tools return, shortened when it's very long, with the connection's own token or password taken out. Roster doesn't take anything else out. Give access only to hires whose work needs it, choose Read only where that's enough, and untick tools that return more than the work needs. Everything a hire does here is on its timecard.

Good to knowCopy Anchor Link

• Hires use Lemon Squeezy while they work on something; changes in Lemon Squeezy don't wake them. To have a hire check it regularly, give it a responsibility on a schedule.
• Without an OpenAPI document, hires get only the general read and send tools, and work out the API's paths from Lemon Squeezy's docs.
• If the sign-in expires or is revoked, hires are told plainly; click Reconnect on the connection.

Learn moreCopy Anchor Link

• Lemon Squeezy's own docs
• lemonsqueezy.com
• Custom APIs
• Approvals
• Every tool

Tools and permissions reference

This reference is built from the same definitions Roster uses to connect Lemon Squeezy and give hires access. It updates with each release.

Authentication and requested permissions

The account or app you connect sets the outer limit. Each hire's access can narrow it further. Connecting a tool gives it to no hire until you give access on that hire's Tools tab.

API authentication

Choose the API's sign-in method in the connection fields below. The available choices, credential fields and scope field are shown there; they depend on your service rather than a fixed OAuth permission list.

No fixed permission list is declared for this connection. Review the sign-in consent screen, the account's roles, and the service's own documentation before connecting.

Connection fields

Lemon Squeezy connection fields

Field	What to provide
Base address baseUrl Optional	Every call stays under this address. Addresses on your own network work too. Starts with: https://api.lemonsqueezy.com/v1.
How it signs in authType Optional	Use the value for your account or connection. Choices: Bearer token (bearer); API key in a header (header); Username and password (basic); OAuth client credentials (client_credentials); No sign-in (none). Starts with: bearer.
Token or key token Optional · sealed secret	Use the value for your account or connection. Shown when authType: bearer or header.
Header name headerName Optional	Use the value for your account or connection. Starts with: X-API-Key. Shown when authType: header.
Username username Optional	Use the value for your account or connection. Shown when authType: basic.
Password password Optional · sealed secret	Use the value for your account or connection. Shown when authType: basic.
Token address tokenUrl Optional	Use the value for your account or connection. Shown when authType: client_credentials.
Client ID clientId Optional	Use the value for your account or connection. Shown when authType: client_credentials.
Client secret clientSecret Optional · sealed secret	Use the value for your account or connection. Shown when authType: client_credentials.
Scope scope Optional	Use the value for your account or connection. Shown when authType: client_credentials.
OpenAPI document openapiUrl Optional	Its address, so hires get one tool per operation. Or upload the file when you test the connection.
Extra headers headers Optional	Sent with every call, one per line as Name: value. Not for secrets: put those above.
Ask before using askFirst Optional	With “Tools that change things”, a hire's call to any tool here that changes something waits for a person's approval in chat, and runs exactly as asked once approved. New connections start there; choose the other option once you trust the hires with this connection. Each hire's Tools tab can also ask for single tools. Choices: Only tools a hire is set to ask about (never); Tools that change things (writes). Starts with: writes.

Per-hire limits

Read-only hires receive only actions that read. Read-and-write access also allows actions that change things, where the connection itself permits them. An empty resource allowlist usually means everything the connected account can reach; each field below explains its meaning.

Lemon Squeezy per-hire limits

Field	What to provide
Tools tools Optional	Leave empty for every tool on this connection.
Paths paths Optional	Path prefixes this hire may call, like /invoices. Leave empty for the whole API.

Actions

Actions come from your OpenAPI document. Without a document, hires use general read (GET) and send (POST, PUT, PATCH, DELETE) actions on the paths you allow.

Use Test connection to inspect the exact names, descriptions and read/write classifications; select the actions and Save tools. Retest when the service changes. A server's read-only labels are supplied by that server: review them before granting access.

Watches and incoming events

• No built-in watch is declared. Give a hire a scheduled responsibility if it should check this service regularly.
• No incoming webhook handler is declared for this integration.

Limits and troubleshooting

• Permission errors: check both the connected account's rights and the hire's resource and read/write limits.
• Expired or revoked access: reconnect or replace the key on the connection.
• Rate limits and unavailable services can interrupt work. The hire's timecard records the outcome.
• The action schema describes accepted inputs. It does not grant additional access or bypass approvals.

Service documentation