API keys: create, rotate, revoke

API keys: create, rotate, revoke

API keys authenticate calls to the LandedFees /v1 API endpoints. Every key is scoped to one workspace, inherits the creating user's role, and is rate-limited at 60 requests per minute. Key management is admin-gated (LFQG-152), so only admins and owners can create, rotate, or revoke.

Keys are shown once at creation. Copy them into your secret manager immediately; there is no way to retrieve the key later.

How to create an API key

1. Open /dashboard/api-keys. Admins and owners only; members and viewers get a 403.
2. Click New key.
3. Enter a name for the key. Use something meaningful ("prod ETL loader", "staging warehouse job").
4. Choose the scope: read (GET endpoints only) or read-write (POST, PATCH, DELETE too).
5. Save. The key is displayed exactly once. Copy it now.
6. Store the key in your secret manager. Never commit it to a repo.

The key format is lf_live_... for production keys.

How to rotate a key

1. Open /dashboard/api-keys.
2. Find the key in the list. Click Rotate.
3. A new key is generated. The old key continues to work for a 48-hour grace period so your services can roll over without downtime.
4. Update your consumers with the new key.
5. Optional: revoke the old key immediately from the same page once every consumer is on the new key.

Rotation is the recommended flow after a credential compromise or on a regular schedule (90 days is a reasonable cadence).

How to revoke a key

Same page, click Revoke. The key stops working immediately. Every in-flight request completes, but new requests return 401.

Tier gate

API access is a Growth tier feature. The api_keys table has a DB-level constraint that rejects inserts on Free and Pro. Upgrade to Growth or above to create keys.

Frequently asked questions

What is the rate limit

60 requests per minute per key. Bursts of up to 100 are absorbed if the sliding average stays under 60. See the API endpoints guide for details.

Can I have more than one key per workspace

Yes. Common to have one key per environment (prod, staging) or per service. There is no hard cap on the number of keys.

What happens on 429

The API returns 429 with a Retry-After header. See the 429 troubleshooting guide.

Are keys logged anywhere

Never. Keys are hashed on write. The audit log records key creations, rotations, and revocations by actor and key ID (not the plaintext key).