> ## Documentation index
> Fetch the complete documentation index at: https://docs.leadity.io/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys and scopes

> Two kinds of key, three scopes, and at most five live keys of each kind per account.

Keys are created and revoked by a person on the [Connectors page](https://app.leadity.io/connectors) of the Leadity app.

## Two kinds of key

Each kind opens one door and nothing else, so you can revoke an agent's access without touching your scripts, and the other way round.

| Kind | Starts with | Works on |
| --- | --- | --- |
| API key | `lk_api_` | The HTTP API at `https://api.leadity.io` |
| MCP key | `lk_mcp_` | The MCP server at `https://mcp.leadity.io/mcp` |

A key sent to the other door is refused with `wrong_key_kind`. A whole key is `lk_`, its kind, an underscore, then 40 letters and digits. After creation the app shows only its first characters, such as `lk_api_7fQ2`, which is enough to tell keys apart and not enough to use one.

## Scopes

A scope is what a key may do. They are chosen when the key is created and never change afterwards.

| Scope | Allows | Examples |
| --- | --- | --- |
| `read` | Everything that takes no credits and changes nothing. Every key has it. | [`list_niches`](https://docs.leadity.io/api-reference/catalog/list-niches), [`estimate_scrape`](https://docs.leadity.io/api-reference/scrapes/estimate-scrape), [`list_leads`](https://docs.leadity.io/api-reference/scrapes/list-leads) |
| `write` | Changes that take no credits. | [`stop_scrape`](https://docs.leadity.io/api-reference/scrapes/stop-scrape), [`rename_scrape`](https://docs.leadity.io/api-reference/scrapes/rename-scrape), [`create_checkout`](https://docs.leadity.io/api-reference/billing/create-checkout), [`create_top_up_checkout`](https://docs.leadity.io/api-reference/billing/create-top-up-checkout) |
| `spend` | Operations that take credits from the balance. | [`create_scrape`](https://docs.leadity.io/api-reference/scrapes/create-scrape), [`create_validation`](https://docs.leadity.io/api-reference/validations/create-validation) |

A new key is read-only unless you tick more. Give a key the least it needs: a dashboard that only reads results never needs `spend`.

> **Tip:** Pricing an order is a read. [`estimate_scrape`](https://docs.leadity.io/api-reference/scrapes/estimate-scrape) and [`preview_validation`](https://docs.leadity.io/api-reference/validations/preview-validation) carry a body but take nothing, so a read-only key can quote everything it cannot buy.

## Limits

- At most **5 live keys of each kind** per account. A sixth is refused, and no key is revoked to make room.
- The secret is shown **once**, when the key is created. Leadity keeps only a digest of it, so a lost key cannot be shown again: revoke it and create another.
- A revoked key stops working on its next request.

## What a key can never do

A key cannot sign in, change the account's email or password, accept legal terms, delete the account, or manage the referral program. Those stay with a person in the app, so a leaked key can never take the account.