API Keys
Create scoped, revocable credentials for the REST API, hosted MCP, and Support public API.
Leenops API keys are workspace-bound bearer credentials. The same key format is used by the REST API, hosted MCP endpoints, the leenops-mcp package, and authenticated Support public-API calls.
Create a key
You must be a workspace Admin or Owner.
- Open Settings > AI > External Connections > API Keys.
- Select API Keys, then create a key.
- Give the key a name and select only the scopes the integration needs.
- Copy the plaintext value immediately. Leenops does not show it again.
Keys start with wks_. Send one on every authenticated request:
Authorization: Bearer wks_example_keyThe legacy Support > Settings > API Keys screen manages the same workspace keys, but Settings > AI > External Connections is the canonical location.
Available scopes
Leenops currently defines 34 scopes: read/write pairs for 17 API areas.
| Area | Read scope | Write scope |
|---|---|---|
| Support tickets | tickets.read | tickets.write |
| CRM | crm.read | crm.write |
| Contacts | contacts.read | contacts.write |
| Deals | deals.read | deals.write |
| Projects | projects.read | projects.write |
| Project tasks / issues | issues.read | issues.write |
| Planning | planning.read | planning.write |
| Assets | assets.read | assets.write |
| Bookings | bookings.read | bookings.write |
| Field service | fsm.read | fsm.write |
| Goals | goals.read | goals.write |
| Marketing | marketing.read | marketing.write |
| Procurement | procurement.read | procurement.write |
| Stock | stock.read | stock.write |
| Subscriptions | subscriptions.read | subscriptions.write |
| Surveys | surveys.read | surveys.write |
| Time | time.read | time.write |
REST reads require a matching read or write scope. Mutations require the
matching write scope. Always issue the smallest scope set needed by the
integration and verify denied operations return 403.
For the Support public API specifically:
tickets.readauthorizesGET /api/public/tickets.tickets.writeauthorizes ticket creation and replies.- Authenticated requests are always restricted to the key's workspace.
Responses
401means the key is missing, malformed, expired, or revoked.403means the key is valid but lacks a required scope.
Revoke or rotate
Revocation takes effect on subsequent requests and cannot be undone. To rotate without downtime:
- Create a second key with the same minimal scopes.
- update the integration and verify it.
- revoke the old key.
Use one key per integration, keep it in a secrets manager or uncommitted environment file, and never place it in browser code.