Authentication
Create LeenOps API keys and understand REST scopes and MCP permissions.
Third-party REST and MCP integrations authenticate with a workspace API key:
Authorization: Bearer lnp_your_api_keyThe first-party /api/v1 routes also accept a verified LeenOps session JWT.
Use an API key for external integrations.
Create an External Connection
- Open Settings > Administration > API & MCP.
- Click Create External Connection.
- Name the connection and choose the smallest useful access preset or scope set.
- Leave optional user delegation off unless the integration needs person-bound
tools such as
my tasksormy time entries. - Optionally set an expiry date.
- Copy the key immediately. It is shown only once.
The canonical settings URL is:
https://workspace.leenops.com/settings/administration/apiNew keys start with lnp_. Legacy wks_ keys remain accepted during the
compatibility period.
LeenOps automatically creates a stable, non-login service identity for the connection. No bot user or workspace member is required. Read External Connection Identities before enabling optional user delegation.
REST example
curl "https://workspace.leenops.com/api/v1/crm/contacts?page=1&limit=10" \
-H "Authorization: Bearer $LEENOPS_API_KEY" \
-H "Accept: application/json"REST scope catalog
Write scopes also satisfy their matching read scope.
| Module | Read scope | Write scope |
|---|---|---|
| Support tickets | tickets.read | tickets.write |
| CRM shared resources | crm.read | crm.write |
| CRM contacts | contacts.read | contacts.write |
| CRM deals | deals.read | deals.write |
| Projects | projects.read | projects.write |
| Issues/tasks | issues.read | issues.write |
| Planning | planning.read | planning.write |
| Assets | assets.read | assets.write |
| Bookings | bookings.read | bookings.write |
| Field service | fsm.read | fsm.write |
| Goals | goals.read | goals.write |
| Marketing | marketing.read | marketing.write |
| Procurement | procurement.read | procurement.write |
| Stock | stock.read | stock.write |
| Subscriptions | subscriptions.read | subscriptions.write |
| Surveys | surveys.read | surveys.write |
| Time | time.read | time.write |
| Documents | documents.read | documents.write |
| Contracts | contracts.read | contracts.write |
| Forms | forms.read | forms.write |
Do not use older granular stock names such as stock.products.read or
stock.movements.write; they are not valid key scopes.
REST requests require a matching read or write scope. A matching write scope
also satisfies reads for that area. If a valid key receives 403, create or
rotate to a key with the smallest scope listed by the endpoint guide.
MCP permissions
MCP tools use granular permissions such as read_contacts,
documents.record.view, documents.record.manage,
contracts.contract.view, and contracts.template.manage. The server derives those permissions
from the key's scope preset unless the key stores an explicit permission map.
Inspect the exact effective permissions and tools for a key:
curl "https://workspace.leenops.com/api/mcp/session" \
-H "Authorization: Bearer $LEENOPS_API_KEY"See MCP tool discovery for the complete permission-aware tool list and schemas.
Authentication failures
| Status | Meaning |
|---|---|
401 | Missing, malformed, inactive, expired, or unknown key |
403 | Valid key but the requested read, mutation, or tool needs another scope or permission |
429 | Rate limit, monthly quota, or agent-trial tool quota reached |
Workspace suspension, deletion, or lifecycle restrictions can also make an otherwise valid key unavailable.
Revoke and rotate
Revocation is immediate and irreversible. Rotation replaces the credential
while preserving the connection's stable service identity and audit history.
Copy the rotated key into the integration, verify it with /api/mcp/session or
a read-only REST request, and remove the previous secret from the client.
Use separate keys per client, set expiries for temporary tests, and never place keys in URLs, screenshots, commits, browser bundles, or shared logs.