API Keys

Per-user API keys enable programmatic access to the LVNG platform. Keys are scoped to your workspace and support fine-grained permission scopes. Use them with any HTTP client.

Base path: /api/v2/api-keys

Key Format

Keys follow a Stripe-style format. The prefix indicates the environment and the first 8 hex characters identify the key for management purposes. The full key is shown only once at creation time.

Key Format

lvng_sk_live_<32 hex characters>
│       │    │
│       │    └── 32 random hex characters
│       └── Environment (live / test)
└── Prefix (identifies as LVNG per-user key)

Permission Scopes

Each key is assigned one or more scopes that control what operations it can perform. JWT-authenticated users have full access regardless of scopes.

ScopeAllowsExample

readGET requests and searchesList workflows, search knowledge or memory

writePOST, PUT, PATCH, DELETECreate, update and schedule workflows

executeExecution endpointsStart and stop workflow runs

adminEvery scope aboveAnything the other scopes allow

knowledge:readKnowledge readsSearch knowledge, read one document

knowledge:writeKnowledge uploadsUpload documents to knowledge

Endpoints

All endpoints require JWT authentication. API keys cannot manage other API keys.

POST/api/v2/api-keysAuthenticated

Generate a new API key. The raw key value is returned only in this response — store it securely.

Body Parameters

namestringrequired

Display name for the key (e.g. "claude-code", "ci-pipeline").

scopesstring[]

Permission scopes. Defaults to ["read", "write", "execute"].

expires_in_daysnumber

Optional expiration in days. Null means no expiration.

Request

cURL

curl -X POST "https://api.lvng.ai/api/v2/api-keys" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

Response 200

{
  "success": true,
  "data": {
    "id": "4a1c5a97-99ae-4a57-9e44-f03e540d25ab",
    "name": "claude-code",
    "key_prefix": "lvng_sk_live_7e8949d6",
    "scopes": ["read", "write", "execute"],
    "plan": "free",
    "created_at": "2026-03-30T15:49:01.068Z",
    "key": "lvng_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  },
  "message": "Store this key securely. It will not be shown again."
}

GET/api/v2/api-keysAuthenticated

List all API keys for the authenticated user. Returns metadata only — never the raw key.

Request

cURL

curl -X GET "https://api.lvng.ai/api/v2/api-keys" \
  -H "Authorization: Bearer YOUR_API_KEY"

Response 200

{
  "success": true,
  "data": [
    {
      "id": "4a1c5a97-...",
      "name": "claude-code",
      "key_prefix": "lvng_sk_live_7e8949d6",
      "scopes": ["read", "write", "execute"],
      "plan": "free",
      "created_at": "2026-03-30T15:49:01.068Z",
      "last_used_at": "2026-03-30T16:12:33.000Z",
      "is_revoked": false
    }
  ],
  "total": 1
}

GET/api/v2/api-keys/:idAuthenticated

Get details of a single API key.

DELETE/api/v2/api-keys/:idAuthenticated

Revoke an API key. Takes effect immediately — all requests using this key will return 401.

Request

cURL

curl -X DELETE "https://api.lvng.ai/api/v2/api-keys/{id}" \
  -H "Authorization: Bearer YOUR_API_KEY"

Response 200

{
  "success": true,
  "message": "API key revoked"
}

POST/api/v2/api-keys/:id/rotateAuthenticated

Rotate a key — revokes the current key and generates a new one with the same name and scopes. Returns the new raw key.

Request

cURL

curl -X POST "https://api.lvng.ai/api/v2/api-keys/{id}/rotate" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

Response 200

{
  "success": true,
  "data": {
    "id": "new-key-uuid",
    "name": "claude-code",
    "key_prefix": "lvng_sk_live_a3b2c1d0",
    "key": "lvng_sk_live_a3b2c1d0..."
  },
  "message": "Store this key securely. It will not be shown again."
}

Using API Keys

Pass your API key via the Authorization: Bearer header. The x-api-key header is also supported as an alternative.

Authentication

# Via Authorization header (recommended)
curl https://api.lvng.ai/api/v2/workflows \
  -H "Authorization: Bearer lvng_sk_live_YOUR_KEY"

# Via x-api-key header (also supported)
curl https://api.lvng.ai/api/v2/workflows \
  -H "x-api-key: lvng_sk_live_YOUR_KEY"

Claude Code Integration

The LVNG MCP server, which connects Claude Code to your workspace with an API key, is not published yet. See SDKs & Claude Code.

Limits

LimitValue

Max active keys per user10

Key name max length100 characters

Key formatlvng_sk_{env}_{32 hex}

StorageSHA-256 hash (never plaintext)

Audit loggingAll operations logged