LanesLanes
Docs/Forms/Security/API keys

API keys

Workspace keys for provisioning pre-claimed forms, managing them, and server-side submissions.

View as Markdown

API keys let you drive Lanes Forms programmatically without the claim flow and without a browser session.

What a key is

  • Keys are prefixed lfk_ (lanes forms key) followed by a random secret.
  • They are workspace-scoped, not per-form. One key manages every form in its workspace.
  • Only the sha256 hash and a short display prefix (for example lfk_a1b2c3d4) are stored. The full key is shown once at creation and can never be retrieved again.

Managing keys

Keys are created and revoked in the dashboard. All three endpoints require a signed-in owner of the workspace.

MethodPathResult
POST/v1/workspaces/{workspace_id}/api-keys201, returns the plaintext key once. Max 10 active keys, then 429 api_key_limit_reached.
GET/v1/workspaces/{workspace_id}/api-keysLists keys (display prefix only, never the secret or hash). Revoked keys included.
DELETE/v1/workspaces/{workspace_id}/api-keys/{key_id}204. Soft-revokes the key; the row is kept for audit.

Copy it now

The plaintext key appears exactly once, at creation. Store it in your secret manager immediately. If you lose it, revoke it and create a new one.

What a key lets you do

A workspace key enables three things:

  1. Provision pre-claimed forms. Send Authorization: Bearer lfk_... on POST /v1/forms and the form is born claimed in the key's workspace, skipping the claim step entirely. See Provisioning.
  2. Manage forms. GET and PATCH /v1/forms/{form_id} and resend-verification accept the workspace key in place of a signed-in owner. Management applies to claimed forms only.
  3. Submit server-side. For a form in api_key submission mode, server-side requests must carry the key. See Securing your endpoints.

What a key cannot do

  • Keys do not authorize dashboard reads (listing submissions, workspaces, projects). Those use your signed-in session.
  • There is no per-form secret. The workspace key, or a signed-in owner, is the only programmatic path to a form.
  • Unknown and revoked keys both return the same 401 invalid_api_key, so a probe cannot tell a wrong key from a revoked one.

Server-side only

An lfk_ key is a secret. Never embed it in a browser bundle, a mobile app, or any client a user can inspect. Browser forms are secured by origin, not by keys. See Securing your endpoints.

Next: Securing your endpoints.