Skip to main content
The Leadey API authenticates with API keys. Each key belongs to one organization, and every request you make with it acts as that organization.

​
API keys

Keys are created in the Cockpit under Settings → API Keys. A key looks like this:
  • The full key is shown once, at creation. Leadey stores only a hash, so a lost key can’t be recovered — create a new one instead.
  • The dashboard lists each key by a masked label (leadey_sk_live_••••a1b2), its creation date, and when it was last used.
  • A key stays valid until you revoke it. Revocation takes effect immediately.
  • Each key has an access level — read only, or read and write — chosen when you create it.

​
Access levels

Every key is read only or read and write, and the choice is made at creation. You cannot change a key’s access afterwards — create a new one. Read only is the default. Prefer it for anything that only pulls data out: if that key leaks, the damage is disclosure rather than data loss. Keys created before write access existed are read only, and behave exactly as they did before. A write sent with a read-only key returns 403. See Writing data for the full picture, including how writes are attributed.

​
Who a key acts as

An API key belongs to a workspace member — by default whoever created it. Reads are org-scoped and do not depend on that member, but every write is recorded as that person’s action: notes carry their name, tasks default to them as assignee, timeline entries carry their user id. If that member is later removed from the workspace, the key keeps working for reads but its writes return 400. Create a new key owned by a current member.

​
Sending your key

Send the key as a Bearer token in the Authorization header on every request.
A request with a missing, malformed, or revoked key returns 401:

​
Keeping keys safe

An API key carries the access of your whole workspace. Treat it like a password.
  • Store keys in environment variables or a secrets manager — never in source control or client-side code.
  • Use a separate key per integration so you can revoke one without disrupting the others.
  • Rotate keys periodically: create the new one, deploy it, then revoke the old one.
  • Revoke immediately if a key may have leaked.

​
Base URL

All endpoints are served under the versioned base URL: