Skip to main content
Every request needs an API key for one business. Owners and admins create and revoke keys in the dashboard.

​
Create a key

1

Open API keys

Go to Settings > API keys. Only owners and admins see the page.
2

Name the key and pick its access

Use a name you’ll recognize later, such as Zapier. Select only the scopes the tool needs.
3

Copy the key

LobbyStack shows the full key once. Store it in your tool or a password manager. LobbyStack keeps only a hash, so nobody can show the key again.
Keys look like lsk_1a2b3c4d_ followed by 32 random characters. The dashboard lists each key by its prefix, lsk_1a2b3c4d, with its scopes, who created it, and when it was last used.

​
Send the key

Put the key in the Authorization header:
A missing, unknown or revoked key returns 401 with the code unauthorized.

​
Test a key

GET /me works with any valid key, whatever its scopes. It returns the key and its business, so an integration can check a connection before it needs a specific scope:

​
Scopes

Each endpoint except GET /me requires one scope. A key without it gets 403 with the code insufficient_scope, and the message names the missing scope.

​
Revoke a key

On Settings > API keys, click Revoke next to the key. Requests with it fail right away, and you can’t undo it. Create a new key if you still need access.

​
Rate limits

Each key can make 120 requests per minute. Self-hosted deployments can change this with PUBLIC_API_RATE_LIMIT_PER_MINUTE. The window resets at the start of each minute. Every response carries these headers: Past the limit, the API returns 429 with the code rate_limited and a Retry-After header with the seconds to wait.

​
Keep keys safe

  • Use one key per tool so you can revoke one without breaking the others.
  • Give each key the fewest scopes that work.
  • Never put a key in browser code or a mobile app. Call the API from a server.
  • LobbyStack logs each request with the key’s ID, never the key itself, and records changes made with a key in the business’s audit log.