> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lancer-erp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and scopes

> Organization API keys, the two ways to send them, and what each scope allows.

Every `/v1` call is authenticated with an **organization API key**. A key belongs to the organization, not to a person: it keeps working when the member who created it leaves, and it can only reach that organization's data.

## Create a key

**1. Open the settings page**

Settings → **API and webhooks** ("API ו-Webhooks"), at [app.lancer-erp.com/app/settings/api](https://app.lancer-erp.com/app/settings/api).

**2. Click New key and pick scopes**

Name the key after where it will live (`n8n production`, `Website form`). Tick only the scopes that integration needs.

**3. Copy the key**

Keys look like `lk_…`. The full key is shown once; afterwards the list shows only its prefix, its scopes and when it was last used.

To rotate a key, create the new one, deploy it, then **revoke** the old one. A revoked key fails immediately with `401`.

## Send the key

Use either header. Both are equivalent.

```bash Authorization header theme={null}
curl https://api.lancer-erp.com/api/v1/clients \
  -H "Authorization: Bearer lk_your_key"
```

```bash X-Api-Key header theme={null}
curl https://api.lancer-erp.com/api/v1/clients \
  -H "X-Api-Key: lk_your_key"
```

> [!WARNING]
>
> API keys are server-side secrets. Never put one in browser JavaScript, a mobile app or a public repository. A website form should post to your own backend (or to n8n / Make), which then calls Lancer.

## Scopes

Each operation needs exactly one scope. A key without it gets `403` with `code: "INSUFFICIENT_SCOPE"`.

| Scope | Label in the app | Allows |
| - | - | - |
| `leads:write` | "יצירת לידים" | `POST /v1/leads` |
| `clients:read` | "קריאת לקוחות" | `GET /v1/clients`, `GET /v1/clients/{id}` |
| `clients:write` | "יצירת לקוחות" | `POST /v1/clients` |
| `projects:read` | "קריאת פרויקטים" | `GET /v1/projects`, `GET /v1/projects/{id}` |
| `payment_requests:read` | "קריאת דרישות תשלום" | `GET /v1/payment-requests`, `GET /v1/payment-requests/{id}` |
| `payment_requests:write` | "יצירת דרישות תשלום" | `POST /v1/payment-requests` |
| `payments:read` | "קריאת תשלומים" | `GET /v1/payments` |

> [!NOTE]
>
> Keys created before scopes existed keep `leads:write` only. To give such an integration more access, create a new key.

## What a key acts as

Requests run inside the key's organization with member-level access. Anything a key creates (a lead, a client, a payment request) shows up in the app like any other record and fires the same [webhooks](https://docs.lancer-erp.com/guides/webhooks.md) and automations. A suspended organization's keys get `403` with `code: "ORG_SUSPENDED"`.

## Personal tokens are different

The [Claude MCP server](https://docs.lancer-erp.com/guides/claude-mcp.md) uses **personal access tokens** (`lpat_…`), not API keys. A personal token acts as one member, with that member's role and permissions. Create those under Automations → Settings → "חיבור Claude".


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.