Authentication
Create Leenops API keys and understand REST scopes and MCP permissions.
Third-party REST and MCP integrations authenticate with a workspace API key:
Authorization: Bearer wks_your_api_keyThe first-party /api/v1 routes also accept a verified Leenops session JWT.
Use an API key for external integrations.
Create an API key
- Open Settings > AI > External Connections > API Keys.
- Select API Keys.
- Click Create API Key.
- Name the key and choose the smallest useful access preset or scope set.
- Optionally set an expiry date.
- Copy the key immediately. It is shown only once.
The canonical settings URL is:
https://workspace.leenops.com/settings/ai?tab=connectionsStandard keys currently start with wks_.
REST example
curl "https://workspace.leenops.com/api/v1/crm/contacts?page=1&limit=10" \
-H "Authorization: Bearer $LEENOPS_API_KEY" \
-H "Accept: application/json"REST scope catalog
Write scopes also satisfy their matching read scope.
| Module | Read scope | Write scope |
|---|---|---|
| Support tickets | tickets.read | tickets.write |
| CRM shared resources | crm.read | crm.write |
| CRM contacts | contacts.read | contacts.write |
| CRM deals | deals.read | deals.write |
| Projects | projects.read | projects.write |
| Issues/tasks | issues.read | issues.write |
| Planning | planning.read | planning.write |
| Assets | assets.read | assets.write |
| Bookings | bookings.read | bookings.write |
| Field service | fsm.read | fsm.write |
| Goals | goals.read | goals.write |
| Marketing | marketing.read | marketing.write |
| Procurement | procurement.read | procurement.write |
| Stock | stock.read | stock.write |
| Subscriptions | subscriptions.read | subscriptions.write |
| Surveys | surveys.read | surveys.write |
| Time | time.read | time.write |
Do not use older granular stock names such as stock.products.read or
stock.movements.write; they are not valid key scopes.
REST requests require a matching read or write scope. A matching write scope
also satisfies reads for that area. If a valid key receives 403, create or
rotate to a key with the smallest scope listed by the endpoint guide.
MCP permissions
MCP tools use granular permissions such as read_contacts, create_contacts,
update_contacts, and delete_contacts. The server derives those permissions
from the key's scope preset unless the key stores an explicit permission map.
Inspect the exact effective permissions and tools for a key:
curl "https://workspace.leenops.com/api/mcp/session" \
-H "Authorization: Bearer $LEENOPS_API_KEY"See MCP tool discovery for the complete permission-aware tool list and schemas.
Authentication failures
| Status | Meaning |
|---|---|
401 | Missing, malformed, inactive, expired, or unknown key |
403 | Valid key but the requested read, mutation, or tool needs another scope or permission |
429 | Rate limit, monthly quota, or agent-trial tool quota reached |
Workspace suspension, deletion, or lifecycle restrictions can also make an otherwise valid key unavailable.
Revoke and rotate
Revocation is immediate and irreversible. To rotate safely:
- Create a replacement key.
- Update the integration.
- Verify the new key with
/api/mcp/sessionor a read-only REST request. - Revoke the old key.
Use separate keys per client, set expiries for temporary tests, and never place keys in URLs, screenshots, commits, browser bundles, or shared logs.