Get started
API keys and scopes
Two kinds of key, three scopes, and at most five live keys of each kind per account.
Keys are created and revoked by a person on the Connectors page of the Leadity app.
Two kinds of key
Each kind opens one door and nothing else, so you can revoke an agent's access without touching your scripts, and the other way round.
| Kind | Starts with | Works on |
|---|---|---|
| API key | lk_api_ | The HTTP API at https://api.leadity.io |
| MCP key | lk_mcp_ | The MCP server at https://mcp.leadity.io/mcp |
A key sent to the other door is refused with wrong_key_kind. A whole key is lk_, its kind, an underscore, then 40 letters and digits. After creation the app shows only its first characters, such as lk_api_7fQ2, which is enough to tell keys apart and not enough to use one.
Scopes
A scope is what a key may do. They are chosen when the key is created and never change afterwards.
| Scope | Allows | Examples |
|---|---|---|
read | Everything that takes no credits and changes nothing. Every key has it. | list_niches, estimate_scrape, list_leads |
write | Changes that take no credits. | stop_scrape, rename_scrape, create_checkout, create_top_up_checkout |
spend | Operations that take credits from the balance. | create_scrape, create_validation |
A new key is read-only unless you tick more. Give a key the least it needs: a dashboard that only reads results never needs spend.
Pricing an order is a read. estimate_scrape and preview_validation carry a body but take nothing, so a read-only key can quote everything it cannot buy.
Limits
- At most 5 live keys of each kind per account. A sixth is refused, and no key is revoked to make room.
- The secret is shown once, when the key is created. Leadity keeps only a digest of it, so a lost key cannot be shown again: revoke it and create another.
- A revoked key stops working on its next request.
What a key can never do
A key cannot sign in, change the account's email or password, accept legal terms, delete the account, or manage the referral program. Those stay with a person in the app, so a leaked key can never take the account.