Skip to main content
Inference, model, and credit endpoints require a customer API key:
Keys begin with lk_ and belong to a project in your workspace. Your Limitless sign-in password, browser session, Supabase project key, and upstream provider key are not customer API credentials.

​
Create a key

Workspace owners and admins can create keys from API keys. Select a name and an optional expiry. A project can have at most 100 active, unexpired keys. The console shows the full secret on creation. Limitless stores its hash for authentication and a short prefix for identification. Keys created through the Administration API can also return the same secret on an exact idempotent creation replay within 24 hours. The console can show the prefix, creation date, expiry, last use, and revocation status, but cannot recover the original secret.

​
Rotate a key

  1. Create a replacement key.
  2. Update your application’s secret manager.
  3. Make a small request and confirm its entry in Activity.
  4. Revoke the old key.
Keep the overlap short. Use separate keys for development, production, and individual integrations so each can be revoked independently.

​
Revoke or expire a key

Revocation blocks subsequent requests immediately. Requests already admitted can still finish. Expired keys are rejected automatically. A key also stops working if its creator no longer has an owner or admin role in the workspace. Removing a member, leaving a workspace, or demoting an admin permanently revokes that person’s customer and Admin API keys in the workspace. Restoring their membership or role does not reactivate those keys; see workspaces and members. An invalid, expired, or revoked key produces 401. Revocation cannot be undone; create a replacement.

​
Keep keys server-side

Store keys in environment variables or a secret manager. Avoid source control, URLs, screenshots, browser storage, and application logs. If a key is exposed, revoke it and issue another. The console playground uses your signed-in session. It does not exercise a customer key; use the quickstart to test key-based access.

​
Scoped customer and Admin API keys

Customer keys can carry models:read, inference:write, and credits:read. Older console keys retain these three permissions. Calls outside a key’s permissions return 403. Customer endpoints also accept x-api-key; an Authorization header takes precedence when both are supplied. The health probes require no key. The /v1/organization routes require a separate lka_ Admin API key. Create the first one from Admin API keys in the console, then grant only the permissions your automation needs. Admin keys cannot be used for inference. See administration for all scopes and examples.