Authentication

All API requests must include a valid API key in the Authorization header using the Bearer scheme.

Header Format

Authorization: Bearer lm_your_api_key_here

API Key Format

Keys follow the format lm_ followed by 40 random characters:

lm_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0

Only the first 8 characters (lm_a1b2c) are stored as a prefix for identification in the dashboard. The full key is shown only once at creation time.

Key Properties

Each API key has:

Property	Description
Name	Human-readable label (e.g., "CRM Integration")
Scopes	Permissions granted to this key
Site IDs	Optional site restriction (null = all sites)
Rate Limit	Max requests per minute (default: 60)
Expires At	Optional expiration date

Scope Checking

The API checks scopes per endpoint. If a key with only leads:read tries to call PATCH /v1/leads/123, the response will be:

{
  "success": false,
  "error": {
    "code": "scope_denied",
    "message": "This API key does not have the 'leads:write' scope"
  }
}

Security Best Practices

• Never expose API keys in client-side code, Git repositories, or public URLs
• Use minimal scopes — only grant the permissions each integration needs
• Restrict to specific sites when the integration only needs data from certain sites
• Rotate keys regularly — revoke old keys and create new ones
• Set expiration dates for temporary integrations
• Monitor usage in the Integrations dashboard — check last_used_at for suspicious activity