API keys

Settings → Developers → Create key. Give it a name, pick its scopes, and copy the key — it is shown once and never again. Then use it as a bearer token against the buyers API.

These are organization keys, and they are not the posting URLs your suppliers use to send leads. Those live in the pipeline canvas and can only ingest (webhook reference). A key from this page acts on your account.

Creating one

The dialog asks for two things.

Name. What system will hold it — "Billing automation", "Ops dashboard". You will read this name in the revoke dialog and in the activity log months from now, so name the holder, not the intent. Up to 60 characters, and no two active keys may share one.

Scopes. What the key may do. Both are ticked by default; untick what the system doesn't need.

A key with buyers:read alone gets 403 insufficient_scope on a pause. Scopes can't be changed after creation — a different set of rights is a different key, created and rolled out on purpose. That is deliberate: widening a key in place would silently upgrade every system already holding it.

Owners and admins can create keys. Members don't see the tab.

The one-time reveal

The key is lm_live_ followed by 43 random characters. LeadMove stores only its fingerprint, so nobody — including us — can show it to you again. The dialog won't let you close it until you've copied the key, and it hands you a ready-to-run curl with the key already in it.

If you lose one: revoke it and create a replacement. There is no recovery, by design.

Keeping a key safe

• Store it in your system's secret manager or environment variables. Never in a repository, a spreadsheet, a ticket, or a URL.
• Never put it in anything that runs in a browser or a mobile app — a key in client-side code is a public key.
• One key per system. Then revoking the one that leaked doesn't take the others down with it.
• Last used in the table tells you whether a key is still in service before you revoke it. It updates at most once a minute, so a key used seconds ago may read "1 minute ago".

Revoking

⋯ → Revoke… on the row. It takes effect immediately: the next request with that key gets 401 key_revoked, including one already in flight.

Two things revoking does not do:

• Buyers the key paused stay paused. Revoking a key is not an undo — resume them from their page in the app, or with another key.
• It doesn't delete the key. Revoked keys move behind Show revoked below the table, so the activity log and the buyer pages can still name what acted. There is no un-revoke.

Limits

Past the rate limit, requests get 429 rate_limited with a Retry-After header saying how many seconds to wait. The budget is per key, so two of your systems never compete for the same one.