> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lovable.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Create and manage API keys

> Create, scope, and revoke workspace API keys (access tokens) for the Lovable API, and set per-key credit limits.

API keys (called **access tokens** in settings) authenticate requests to the [Lovable API](/integrations/lovable-api). Each key belongs to one workspace and can only access that workspace's projects and data. The public API manages and deploys existing projects, and its current endpoints, including deployment builds, do not consume AI build credits.

Creating and managing keys requires a Business or Enterprise plan, and an owner or admin role in the workspace.

## Create an API key

Each key gets its own name, scopes, expiry, and optional spending cap, so give each integration its own key.

<Steps>
  <Step title="Open the Access tokens settings">
    Go to [**Settings → Access tokens**](https://lovable.dev/settings/api-keys) and click **New API key**.
  </Step>

  <Step title="Name the key">
    Enter a **Key name** that helps you recognize the key later, for example `CI/CD pipeline` or `Zapier`. The name is visible to workspace admins and owners.
  </Step>

  <Step title="Set a credit limit (optional)">
    Set a **Credit limit** to cap how many AI build credits requests using this key can spend each calendar month. The cap resets at 00:00 UTC on the first day of each month. Leave it blank for no limit.
  </Step>

  <Step title="Choose an expiration">
    Choose an **Expiration**: 7, 30, 60, 90, or 180 days, 1 year, or **Never**. "Never" works for long-lived service integrations, but rotating keys regularly is safer.
  </Step>

  <Step title="Grant access">
    Under **Access**, choose **None**, **Read**, or **Read & write** for each resource. You must grant at least one:

    * **Projects**: read and modify projects settings, delete projects, publish projects, and read project security scans in this workspace.
    * **Workspace**: list projects, and read workspace details, members, groups, security insights, and analytics.

    The **Read only** and **Full access** presets fill in both resources at once.
  </Step>

  <Step title="Create and copy the key">
    Click **Create**, then copy the key value.
  </Step>
</Steps>

<Warning>
  The secret value is shown only once, right after the key is created. Copy it and store it somewhere safe before leaving the page. If you lose it, you need to create a new key.
</Warning>

## Use the key

Send the key in the `Lovable-API-Key` header on every request:

```bash theme={null}
curl https://api.lovable.dev/v1/workspaces \
  -H "Lovable-API-Key: lov_YOUR_KEY" \
  -H "Lovable-Version: 2026-09-11" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json"
```

## Manage existing keys

The **Access tokens** page lists every key in the workspace with who created it, when it was created and last used, and its credit usage. Select a key to see its details, including its scopes, expiry, and credit limit.

* **Change the credit limit**: open the key's menu and click **Edit credit limit**. You can raise, lower, or remove the cap at any time.
* **Revoke a key**: open the key's menu and click **Revoke key**, then confirm. Revocation is permanent and normally takes effect immediately, but allow a brief propagation delay. It does not cancel work already accepted. Anything still using the key loses access.

Scopes and expiry are fixed when the key is created. To change them, create a new key and revoke the old one.

## Keep keys safe

Keep the following in mind:

* Store keys in a secret manager or environment variable, never in code or version control.
* Grant only the scopes each key needs, and prefer an expiry date over "Never."
* Give each integration its own key, so you can revoke one without breaking the others.
* Lovable partners with GitHub secret scanning: when GitHub secret scanning detects and reports an exposed supported Lovable API key (keys start with `lov_`), Lovable revokes it automatically and sends an email notification. Treat a key exposed anywhere else as compromised and revoke it yourself.

<Note>
  When storing a key as a [project secret](/features/secrets), do not name it `LOVABLE_API_KEY`. Lovable creates and manages a secret with that exact name in each project, and names starting with `LOVABLE_` are reserved. Pick a different name, such as `LOV_PUBLIC_API_KEY`.
</Note>

## FAQ

<AccordionGroup>
  <Accordion title="Who can create and see API keys?">
    Workspace owners and admins on Business and Enterprise plans. They see every key in the workspace, including keys created by others, but not a key's secret value.
  </Accordion>

  <Accordion title="Can I see the secret value of a key again?">
    No. The secret is shown once, when the key is created. If you lose it, create a new key and revoke the old one.
  </Accordion>

  <Accordion title="What happens when a key expires?">
    Requests using the key start failing. Expiry does not delete the key from the list, so you can see what expired, but you need to create a new key to restore access.
  </Accordion>

  <Accordion title="What does the credit limit do?">
    It caps how many AI build credits requests authenticated with that key can spend each calendar month. The cap resets at 00:00 UTC on the first day of each month, independently of your subscription renewal date. The API currently manages and deploys existing projects and does not expose AI project creation or editing, so no current endpoint spends AI build credits. Deployment builds through the publish endpoint do not spend them either. When the cap is reached, requests that would spend credits fail until the next month starts or until you raise the limit. Requests that do not spend credits are not affected by the cap.
  </Accordion>

  <Accordion title="Is revoking a key reversible?">
    No. Revoking is permanent and normally takes effect immediately, though a brief propagation delay is possible. Create a new key if you need access again.
  </Accordion>
</AccordionGroup>


## Related topics

- [API basics](/integrations/api-ref-intro.md)
- [Lovable API](/integrations/lovable-api.md)
- [FAQ](/introduction/faq.md)
- [Connect your app to Attention](/integrations/attention.md)
- [Connect your app to Brevo](/integrations/brevo.md)