--- title: "Developer API keys" description: "Create and manage API keys to build LeyApp search, availability and booking flows into your own product." source: https://staging.leyapp.es/en/help/developer-api-keys locale: en updated: 2026-07-25T12:00:00Z --- # Developer API keys Create and manage API keys to build LeyApp search, availability and booking flows into your own product. _Source: https://staging.leyapp.es/en/help/developer-api-keys — Last updated: July 25, 2026_ > **Note** > This article is about **API keys** (leyk_...) for developers calling LeyApp's REST API from their own software. If you just want to connect an AI assistant like Claude or ChatGPT to your LeyApp account, you don't need an API key — see "Connect your AI assistant to LeyApp" instead. ## What is the developer API? LeyApp exposes a public REST API under /api/v1 that lets you search lawyers, read availability, and start bookings from your own website, app, or internal tool. Basic read access works without any credentials, but an API key raises your rate limits, unlocks additional endpoints, and gives you a dashboard with your keys and usage. Any LeyApp account can create API keys — you don't need a special account type. Bookings started through the API are never charged automatically: the client always confirms and pays on leyapp.es, so your integration never handles money or card details. ## Creating an API key Keys are managed from your dashboard: 1. Open Dashboard → Developer from the sidebar. 2. Click "Create key" and give it a descriptive name, e.g. "Website widget (production)". 3. Choose the key type: Live for real requests, or Test to experiment safely. 4. Copy the key immediately and store it somewhere safe, like a password manager or your hosting provider's secret storage. > **Warning** > The full key is shown exactly once, right after creation. LeyApp only stores a fingerprint of it, so it can never be displayed again. If you lose a key, revoke it and create a new one. ## Test keys vs live keys Test keys (leyk_test_...) behave exactly like live keys — same endpoints, same responses, same validation — with one crucial difference: nothing real happens. A test booking request is fully checked against real availability, but no booking intent is created and no lawyer is notified. Live keys (leyk_...) create real booking intents. When a client follows the confirmation link of a live intent, they are taken to the normal LeyApp payment and confirmation flow. > **Tip** > Build your integration against a test key first. When everything works, swap in a live key — no code changes needed beyond the key itself. ## Firm keys If you belong to a law firm on LeyApp, Dashboard → Developer shows two separate lists: your personal keys and your firm's keys. A firm key belongs to the firm, not to the person who created it, so it keeps working when that person changes role or leaves. Owners and administrators can manage firm keys straight away. Every other member starts with no access at all and has to be granted it one capability at a time, from the firm's member list: - View — see the firm's keys, their prefixes, and when each was last used. The secret itself is never shown again to anyone, including owners. - Manage — create, revoke, suspend, and restrict the firm's keys. - Webhooks — manage the firm's webhook endpoints. Two extra controls apply to firm keys. You can restrict a key to a list of IP addresses or ranges, so that even a leaked key is refused from anywhere else. And you can suspend a key to pause it without destroying it, which is useful while you investigate something odd. > **Note** > When a member who created firm keys leaves, those keys keep working and the firm's owners and administrators are emailed about it. That is deliberate: revoking on departure would take down whatever the firm runs on them. Roll them instead — create a replacement, move the integration across, then revoke the old one. ## Using your key Send the key in the Authorization header of every request: "Authorization: Bearer leyk_...". Requests without a key still work for public endpoints, but at lower anonymous rate limits. Every response includes an X-Request-Id header. If something behaves unexpectedly, include that ID when you contact support — it lets us find your exact request in seconds. ## Rate limits New keys start on the free tier: 60 requests per minute and 5,000 per day. Every response tells you where you stand via the X-RateLimit-Limit and X-RateLimit-Remaining headers; if you exceed the limit you receive a 429 response with a Retry-After header telling you when to try again. Higher tiers for partners exist and are granted by the LeyApp team — contact us through the support form if your integration needs more headroom. ## Keeping keys safe An API key is a password for your integration. Treat it like one: - Never put a key in client-side code, mobile apps, or public repositories — anyone who can read it can spend your rate limit and act within the key's scopes. - Use a separate key per integration or environment, so you can revoke one without breaking the others. - Revoke keys you no longer use. Revocation is immediate — requests with a revoked key fail on the next call. - If a key may have leaked, revoke it right away in Dashboard → Developer and create a replacement. Rotation is zero-downtime: create the new key first, deploy it, then revoke the old one. ## Troubleshooting I get a 401 "Invalid API key". Check that the header is exactly "Authorization: Bearer leyk_..." with no extra spaces, and that the key hasn't been revoked. Note that MCP tokens (ley_...) from Settings → API Tokens are a different credential and are not valid on the REST API. I get a 429 "Rate limit exceeded". You've hit your tier's per-minute or per-day window. Honour the Retry-After header and retry with exponential backoff. If you hit the daily cap regularly, ask us about a higher tier. My test bookings never appear anywhere. That's by design — test keys validate everything but create nothing. Switch to a live key to create real booking intents. I cannot lift a suspension on one of my firm's keys. A key can be suspended by your firm or by LeyApp. Your firm's own suspensions can be lifted by any owner or administrator. A suspension placed by LeyApp — for example while we look into unusual traffic — can only be lifted by us, so contact support@leyapp.es. > **Note** > Full endpoint reference, request and response examples, and integration guides live on the developer portal at leyapp.es/developers.