Authentication and keys
Send an API key, or an access token from the sign in of an assistant, as a bearer token on every call:
Authorization: Bearer lik_ws_a1b2c3d4e5f6.your-secretNothing else is read. There is no cookie and no session, and a key placed in the query string is ignored. The API does not allow calls from a web page in a browser: it is meant for your servers and scripts.
Workspace keys and organization keys
- A workspace key (it starts with
lik_ws_) works in one workspace. It never needs to name it. - An organization key (it starts with
lik_org_) works in a list of workspaces chosen when it was made. With one workspace on the list it never needs to name it either. With several, each call names one of them, and the error says which ids are allowed. It can also read the organization level calls, such asGET /organization/workspacesand the billing reads.
An assistant that signs in is connected the same way: to one workspace, or to all the workspaces of an organization the person owns.
A key acts as a person
A key acts as the person who made it, checked fresh on every call. It may do only what both that person and the key's scopes allow. If the person is demoted or removed, or their access to some accounts is limited, the key follows on the next call. A key never does more than its maker.
What a key cannot do
Some things stay with people, for any key or connection:
| Stays in the app | Why |
|---|---|
| Billing changes: checkout, the payment portal, seats, paying now, resuming a subscription | A person completes a payment page and sees the price. Reading the plan, seats and invoices is allowed. |
| Deleting a workspace or the organization, and removing an account with erasure | It cannot be undone. Disconnecting an account and keeping what it holds is open to a key; connecting it again needs the browser, because the session is captured there. |
| Making, showing and ending keys and connections | A leaked key must not be able to make another. |
| Support access, password, second factor and sign in methods | They prove who a person is or give a consent only a person gives. |
| Inviting, removing and changing the role of members, and which inboxes a member sees | Access control stays with people. |
Scopes and presets
A scope is a permission name such as campaigns.campaign.read, grouped by what it is about. A connection from an assistant holds everything its person can do except the list above, or only the reads if the person chose Limit to read only. A key is made with a name, an expiry and a Read only checkbox; the advanced picker offers presets and a custom list:
| Preset | What it can do |
|---|---|
| Read only | Every read. It cannot change anything, not even mark a conversation read. |
| Standard | Every read, and the changes that send nothing: templates, lead lists, leads, imports, campaign drafts, account settings, inbox state. |
| Full access | Everything a key may do: also replying, starting, resuming and changing campaigns, the do-not-contact list, erasing a lead, reading billing (organization keys), and webhook endpoints. Contact operations run at once, within the account limits, see Contacting people. |
Each operation in the API reference names the scope it needs. Erasing a lead (leads.lead.erase) cannot be undone, so the advanced picker marks it as dangerous and it needs confirm: true on the call. Webhook endpoints send your data to an address you choose, so they need their own scope, workspace.webhook.manage, which only Full access or a custom key can hold and which no connection holds. A scope you do not hold yourself cannot be given to a key.
Expiry and rotation
A key lasts 90 days unless you choose another lifetime between 1 and 365 days. Nothing longer is offered.
To rotate a key, use Replace in the app. You get a new key with the same grant, and the old one keeps working for 24 hours so you can switch without a gap. To stop a key at once, revoke it.
When a call is refused
A missing, wrong, expired or revoked key, and a key whose maker has left, all answer the same 401 with no detail. A key that is valid but may not do the thing answers 403. A workspace the key cannot reach and one that does not exist look the same, so a key cannot be used to find out which workspaces exist.
Workspace administrators can switch off all agent access to a workspace at any time. Every call of every key and connection into it then answers 403 with the code agent_access_paused until a person turns it back on.
Managing keys
Keys are made and managed in the app, under Settings, API and connections, by workspace administrators (organization keys by the organization owner). A key can never make, show or end keys, so this is not part of the API.