Skip to main content
Every /v1 call is authenticated with an organization API key. A key belongs to the organization, not to a person: it keeps working when the member who created it leaves, and it can only reach that organization’s data.

​
Create a key

1

Open the settings page

Settings → API and webhooks (“API ו-Webhooks”), at app.lancer-erp.com/app/settings/api.
2

Click New key and pick scopes

Name the key after where it will live (n8n production, Website form). Tick only the scopes that integration needs.
3

Copy the key

Keys look like lk_…. The full key is shown once; afterwards the list shows only its prefix, its scopes and when it was last used.
To rotate a key, create the new one, deploy it, then revoke the old one. A revoked key fails immediately with 401.

​
Send the key

Use either header. Both are equivalent.
API keys are server-side secrets. Never put one in browser JavaScript, a mobile app or a public repository. A website form should post to your own backend (or to n8n / Make), which then calls Lancer.

​
Scopes

Each operation needs exactly one scope. A key without it gets 403 with code: "INSUFFICIENT_SCOPE".
Keys created before scopes existed keep leads:write only. To give such an integration more access, create a new key.

​
What a key acts as

Requests run inside the key’s organization with member-level access. Anything a key creates (a lead, a client, a payment request) shows up in the app like any other record and fires the same webhooks and automations. A suspended organization’s keys get 403 with code: "ORG_SUSPENDED".

​
Personal tokens are different

The Claude MCP server uses personal access tokens (lpat_…), not API keys. A personal token acts as one member, with that member’s role and permissions. Create those under Automations → Settings → “חיבור Claude”.