Developer API keys

What is the developer API?

LeyApp exposes a public REST API under /api/v1 that lets you search lawyers, read availability, and start bookings from your own website, app, or internal tool. Basic read access works without any credentials, but an API key raises your rate limits, unlocks additional endpoints, and gives you a dashboard with your keys and usage.

Any LeyApp account can create API keys — you don't need a special account type. Bookings started through the API are never charged automatically: the client always confirms and pays on leyapp.es, so your integration never handles money or card details.

Creating an API key

Keys are managed from your dashboard:

1. Open Dashboard → Developer from the sidebar.
2. Click "Create key" and give it a descriptive name, e.g. "Website widget (production)".
3. Choose the key type: Live for real requests, or Test to experiment safely.
4. Copy the key immediately and store it somewhere safe, like a password manager or your hosting provider's secret storage.

Test keys vs live keys

Test keys (leyk_test_...) behave exactly like live keys — same endpoints, same responses, same validation — with one crucial difference: nothing real happens. A test booking request is fully checked against real availability, but no booking intent is created and no lawyer is notified.

Live keys (leyk_...) create real booking intents. When a client follows the confirmation link of a live intent, they are taken to the normal LeyApp payment and confirmation flow.

Using your key

Send the key in the Authorization header of every request: "Authorization: Bearer leyk_...". Requests without a key still work for public endpoints, but at lower anonymous rate limits.

Every response includes an X-Request-Id header. If something behaves unexpectedly, include that ID when you contact support — it lets us find your exact request in seconds.

Rate limits

New keys start on the free tier: 60 requests per minute and 5,000 per day. Every response tells you where you stand via the X-RateLimit-Limit and X-RateLimit-Remaining headers; if you exceed the limit you receive a 429 response with a Retry-After header telling you when to try again.

Higher tiers for partners exist and are granted by the LeyApp team — contact us through the support form if your integration needs more headroom.

Keeping keys safe

An API key is a password for your integration. Treat it like one:

• Never put a key in client-side code, mobile apps, or public repositories — anyone who can read it can spend your rate limit and act within the key's scopes.
• Use a separate key per integration or environment, so you can revoke one without breaking the others.
• Revoke keys you no longer use. Revocation is immediate — requests with a revoked key fail on the next call.
• If a key may have leaked, revoke it right away in Dashboard → Developer and create a replacement. Rotation is zero-downtime: create the new key first, deploy it, then revoke the old one.

Troubleshooting

I get a 401 "Invalid API key".

Check that the header is exactly "Authorization: Bearer leyk_..." with no extra spaces, and that the key hasn't been revoked. Note that MCP tokens (ley_...) from Settings → API Tokens are a different credential and are not valid on the REST API.

I get a 429 "Rate limit exceeded".

You've hit your tier's per-minute or per-day window. Honour the Retry-After header and retry with exponential backoff. If you hit the daily cap regularly, ask us about a higher tier.

My test bookings never appear anywhere.

That's by design — test keys validate everything but create nothing. Switch to a live key to create real booking intents.