Authentication

A single API key per workspace, sent as a header on every request.

Updated

Planned credential: the API key

Leadee's API will authenticate with a single workspace-scoped API key, sent as a header on every request:

http
Authorization: Bearer <leadee_api_key>

Each paid plan includes a monthly allowance of API/MCP calls (see the pricing page); the key you use is counted against your workspace's allowance regardless of whether the call comes from your own code, a script, or an MCP-connected AI agent.

Creating and rotating keys

Once the dashboard ships, API keys will be created and revoked from your workspace settings. Rotating a key immediately invalidates the old one — there is no overlap window, so plan a coordinated deploy when you rotate a key already in use.

MCP server

The same API key will authenticate requests from the Leadee MCP server, so an AI agent with MCP access can read Visibility Tracker metrics or Fix Engine tickets using the same credential as a direct API call.

Never publish a key client-side

API keys are a server-side credential. Leadee has no separate "public" or browser-safe token — never embed an API key in a browser bundle or a public repository.