Authentication

Create an API key

In the Lancer web app, go to Settings, then Integrations, and open the API keys tab. Click Create key and give it a name.

The full key is shown once, at creation. Copy it immediately; afterwards the list only shows the first 11 characters. If you lose a key, create a new one and delete the old one.

You can also manage keys through the MCP server with the api_key_create and api_key_delete tools.

Key format and scope

lk_9f2c4e6a8b1d3f5079e2c4a6b8d0f1a3c5e7092b4d6f8a0c2e4b6d8f0a1c3e5f

• Keys start with lk_ followed by 64 hex characters.
• Keys are organization-scoped. One key works for every campaign in the organization.
• You can create multiple keys (for example one per environment) and revoke them independently.
• Lancer stores only a hash of the key. It can never be displayed again after creation.

Creating keys requires an active paid subscription.

Authenticate requests

Send the key as a bearer token on every request:

curl https://api.lancer.app/v1/campaigns/CAMPAIGN_ID/leads \
  -H "Authorization: Bearer lk_..."

There is no query parameter or custom header alternative. Missing or malformed tokens get:

{ "statusCode": 401, "message": "Missing bearer token" }

Revoked or unknown keys get 401 "Invalid API key". If the organization's subscription lapses or billing collection is paused, valid keys also get 401 with a message explaining the billing state.

Key hygiene

• Store keys in your secret manager, never in client-side code or repositories.
• Rotate by creating a new key, switching your systems over, then deleting the old key. Deletion takes effect immediately.
• Each key's last-used time is shown in the web app, which makes it easy to spot dead keys before deleting them.