# Create an API key

> Generate a LeadLex API key, choose what it can read and change, and revoke it when you no longer need it.

Source: https://www.leadlex.com/help/ai-and-api/create-an-api-key
Last updated: 2026-10-21

An API key lets a script, an integration or another tool work with your LeadLex workspace without a person signing in. Each key is tied to your workspace and carries only the permissions you give it.

Only workspace admins can create and revoke keys. If you do not see **API & Data** in Settings, ask an admin on your team.

If you want to use Claude or ChatGPT, you do not need a key. See [Connect Claude or ChatGPT to LeadLex](/help/ai-and-api/connect-claude-or-chatgpt).

## Create a key

1. Open **Settings** and choose **API & Data**.
2. Choose **Create Key**.
3. Enter a **Key Name** that tells you what the key is for, for example "Bot Integration". Add a **Description (optional)** if it helps.
4. Pick the permissions. Choose one of the **Quick Presets** to start, then adjust.
5. Choose **Create Key**.
6. Copy the key straight away. LeadLex shows it once, with the message "Copy your API key now". It will not be shown again.

![The Create Key form with the permission presets](/help/create-an-api-key/create-key.webp "Create Key in Settings, API & Data, with Quick Presets and Permissions.")

Store the key in your password manager or your tool's secret store. Do not paste it into chat, tickets or source code.

## Choose permissions

Each area has its own setting: **Contacts**, **Deals**, **Companies**, **Activities**, **Campaigns**, **Prospector**, **Lexi AI** and **Webhooks**. For most you choose **Off**, **Read** or **R&W** (read and write). **Lexi AI** is simply **Off** or **On**.

| Preset | What it gives |
|---|---|
| **Full Access** | Read and write on every area, and Lexi AI |
| **Read Only** | Read on every area except Lexi AI |
| **CRM Only** | Read and write on contacts, deals, companies and activities |

Give a key the least it needs. A reporting script needs **Read Only**, not **Full Access**. You must select at least one permission.

## Use the key

Send the key with each request, in the `Authorization` header as a bearer token. The `x-api-key` header also works.

```
Authorization: Bearer wbk_...
```

The full request examples, the API address and the list of endpoints are in the developer docs. Start with the [quickstart](https://docs.leadlex.com/quickstart). Requests go to `https://data.leadlex.com/functions/v1/api-gateway`.

## Check and revoke keys

The list under **Create Key** shows each key by name and the first characters of the key, with a status of **Active**, **Expired** or **Revoked**. To stop a key working, choose the bin icon on its row. A revoked key stops working straight away and stays in the list as **Revoked**.

Revoke a key as soon as someone who knew it leaves, or if you think it has leaked, then create a new one.

## What happens next

Review the list now and then and revoke keys nobody uses. For where your data lives and who can reach it, see [Security, data location and GDPR](/help/account/security-data-location-gdpr).