> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trylimitless.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and keys

> Create, protect, rotate, and revoke customer API keys.

Inference, model, and credit endpoints require a customer API key:

```http theme={null}
Authorization: Bearer YOUR_LIMITLESS_CUSTOMER_KEY
```

Keys begin with `lk_` and belong to a project in your workspace. Your Limitless sign-in password, browser session, Supabase project key, and upstream provider key are not customer API credentials.

## Create a key

Workspace owners and admins can create keys from **API keys**. Select a name and an optional expiry. A project can have at most 100 active, unexpired keys.

The console shows the full secret on creation. Limitless stores its hash for authentication and a short prefix for identification. Keys created through the Administration API can also return the same secret on an exact idempotent creation replay within 24 hours. The console can show the prefix, creation date, expiry, last use, and revocation status, but cannot recover the original secret.

## Rotate a key

1. Create a replacement key.
2. Update your application's secret manager.
3. Make a small request and confirm its entry in Activity.
4. Revoke the old key.

Keep the overlap short. Use separate keys for development, production, and individual integrations so each can be revoked independently.

## Revoke or expire a key

Revocation blocks subsequent requests immediately. Requests already admitted can still finish. Expired keys are rejected automatically. A key also stops working if its creator no longer has an owner or admin role in the workspace. Removing a member, leaving a workspace, or demoting an admin permanently revokes that person’s customer and Admin API keys in the workspace. Restoring their membership or role does not reactivate those keys; see [workspaces and members](/guides/workspaces).

An invalid, expired, or revoked key produces `401`. Revocation cannot be undone; create a replacement.

## Keep keys server-side

Store keys in environment variables or a secret manager. Avoid source control, URLs, screenshots, browser storage, and application logs. If a key is exposed, revoke it and issue another.

The console playground uses your signed-in session. It does not exercise a customer key; use the [quickstart](/quickstart) to test key-based access.

## Scoped customer and Admin API keys

Customer keys can carry `models:read`, `inference:write`, and `credits:read`. Older console keys retain these three permissions. Calls outside a key's permissions return `403`.

Customer endpoints also accept `x-api-key`; an `Authorization` header takes precedence when both are supplied. The health probes require no key.

The `/v1/organization` routes require a separate `lka_` Admin API key. Create the first one from **Admin API keys** in the console, then grant only the permissions your automation needs. Admin keys cannot be used for inference. See [administration](/guides/administration) for all scopes and examples.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.