Skip to main content
API keys authenticate requests to the /v1 Public API. Every key belongs to a service account and is created from that account’s detail page in the Developer Hub. Use a scoped API key for a private backend integration when securely storing and rotating a secret meets your requirements. No OAuth client or token exchange is needed. See Authentication if your organization requires short-lived OAuth access tokens instead.

​
Anatomy of a key

  • Identifier — starts with ak_. Safe to reference in tickets, logs, and configuration; it grants nothing by itself.
  • Secret — starts with lsk_live_. This is the credential your integration presents. It is shown once, at creation or rotation, and cannot be retrieved later. The key list shows only the last four characters (for example lsk_live_…xQc4) so you can match a row to the credential a caller holds.
  • Permissions — a subset of the owning service account’s permissions, chosen at creation. A key can never do more than its account allows.
  • Expiration — mandatory. Every key has an expiry date.
Store secrets in a secret manager the moment they are shown. Never commit them to version control, embed them in client-side code, or share them in chat. Anyone holding the secret can act with the key’s permissions.

​
Create a key

On the service account’s detail page, create a key by walking four steps: name it, pick the permissions this specific key needs, choose an expiration — 30, 90, or 365 days, or a custom period up to a year — and review. The secret is displayed on completion, once. Scope each key to the narrowest permission set its caller needs, even when the account allows more. If a key leaks, its permissions are the blast radius.

​
Rotate without downtime

Rotation issues a new secret and starts an overlap window — 1 hour, 24 hours, or 7 days — during which the old secret keeps working. That lets you roll the new secret through your deployments at your own pace:
1

Rotate the key

Choose an overlap window that covers your slowest deployment path. The new secret is shown once — store it immediately.
2

Update your integrations

Replace the old secret everywhere it is configured. The key’s status shows as in-overlap until the window ends.
3

Verify before the window closes

Use the request logs to confirm traffic has moved to the new secret. When the overlap ends, the old secret stops authenticating.
Rotate ahead of expiry, too: keys approaching their expiration date are flagged as Expiring soon in the key list. An expired key stops authenticating — requests made with it return a 401 with code credential_expired.

​
Expiry notifications

When expiry notifications are enabled for your organization, Living Security emails and notifies admins before service-account API keys cross configured thresholds (for example 30, 14, 7, and 1 days before expiry, plus when a key expires). Configure organization defaults from Settings → Integrations & Developers → Developer Hub → Expiry notifications: On a service account’s detail page, open the Expiry notifications tab to override recipients for that account only. Clearing the override returns the account to the organization list.

​
Revoke immediately

Revocation takes effect immediately and is permanent — there is no overlap window and no undo. Revoke a key the moment you suspect its secret has been exposed; rotate instead when you are replacing a healthy credential. Requests made with a revoked key return a 401 with code credential_revoked. If you need to stop every key an integration holds at once, disable its service account instead.