API Keys — how this works

In the app: /settings/api-keys

How it works

Keys authenticate the public REST API at /api/v1. Minting shows the secret ONCE and stores only its sha256 hash — a database leak yields no usable key. Each key carries least-privilege scopes (leads:read, leads:write) and a per-minute rate limit; a request over the limit gets 429 + Retry-After. Revoking is instant and permanent: a revoked key authenticates nothing.

Data source

src/lib/api/apiKeyRepo.ts (mint/list/revoke) and src/lib/api/apiAuth.ts (the request-time verify/scope/rate-limit each /api/v1 route runs).

Troubleshooting

A caller getting 401? The key may be revoked, or they are sending the display prefix instead of the full secret (which is unrecoverable — mint a new one). Getting 403? The key lacks the scope the endpoint requires. Getting 429? They exceeded the key's per-minute rate limit — raise it here or have them back off per Retry-After.

Who can see this: admin