API keys

An API key lets software you build, such as a script or an integration, call the Lightfield API. Settings → API keys lists every key, and is where you create keys, change what they can do, and revoke them. For credentials going the other way, from Lightfield to an outside service, see Secrets.

Who can use it

Every plan. Only owners and admins see Settings → API keys; members and Viewers who open the address see You don’t have access to this page. The agent can’t create keys in chat.

A key acts as the admin who created it and can’t do more than that admin’s role could at the time. If that admin is later deactivated or moved to a lower role, the key shows Invalidated and stops working.

See your keys

The table lists every active key with its Name, Key, Type, Created by, Scopes, Created and Last used (Never if nobody has used it). Key shows only the end of the key, such as sk_lf_...a1b2. Revoked keys leave the list. The name and actions stay in view while you scroll across the table.

Create an API key

You see the key only once, so copy it before you close the dialog.

1. Go to Settings → API keys and click Create API key.
2. Under Name, say which integration uses it, such as Zapier production, so you can revoke the right one later.
3. Under Scopes, tick what the key may do. Each row is a record type, such as Accounts or Contacts, with Read, Create, Update, Delete and Restore. Select all ticks everything. A Custom objects row appears when your workspace has custom objects. Start with the fewest scopes the integration needs; you can add more later.
4. Click Create.
5. In API key created, click Copy, store the key somewhere safe, then click Done.

The key appears in the table with Type set to User. Without a name or a scope you see Enter a name for the API key or Select at least one scope. To use the key, see API keys and Scopes in the developer docs.

Change a key’s scopes

The key’s value stays the same. Removing a scope stops requests that need that permission.

Keys made before scopes existed show Full access. Saving limits them to the scopes you select, and they will not automatically gain scopes Lightfield adds later. Check what the integration needs before saving.

1. In the key’s row, click Edit scopes.
2. In Scopes for, tick or clear boxes, keeping at least one.
3. Click Save.

API key scopes updated confirms it, and the change applies from the next request.

Revoke an API key

Revoking is immediate and can’t be undone. Anything using the key stops working, so check Last used and update or replace the integration first.

1. In the key’s row, click Revoke.
2. In Revoke API key, check the key’s name, then click Revoke.

API key revoked confirms it, and the key leaves the table. To restore access, create a new key and give it to the integration. If a key leaked, see Leaked API key remediation.

Troubleshooting

I don’t see API keys in Settings

Your role doesn’t include it. Ask an owner or admin to create the key, or to make you an admin in Members.

An integration stopped working

• The key was revoked. Revoked keys leave the table. Create a new key and give it to the integration.
• The key shows Invalidated. The admin who created it was deactivated or lost their role. Create a new key as an active admin and revoke the old one.
• A scope was removed. Click Edit scopes and tick the scope the integration needs.

Common questions

Can I see an API key again after I create it? No. It shows once, in API key created. Create a new key if you lost it.

Can I change the scopes on an existing key? Yes. Click Edit scopes on its row. The key’s value stays the same.

Can I undo revoking a key? No. Create a new key and give it to the integration.

Does a key stop working if its creator leaves? Yes. Once the creator is deactivated, the key shows Invalidated. Create keys from an admin who will stay.