# API keys

> Workspace keys for provisioning pre-claimed forms, managing them, and server-side submissions.

API keys let you drive Lanes Forms programmatically without the claim flow and without a browser session.

## What a key is

- Keys are prefixed **`lfk_`** (lanes forms key) followed by a random secret.
- They are **workspace-scoped**, not per-form. One key manages every form in its workspace.
- Only the **sha256 hash** and a short display prefix (for example `lfk_a1b2c3d4`) are stored. The full key is shown **once** at creation and can never be retrieved again.

## Managing keys

Keys are created and revoked in the dashboard. All three endpoints require a signed-in **owner** of the workspace.

| Method | Path | Result |
| --- | --- | --- |
| `POST` | `/v1/workspaces/{workspace_id}/api-keys` | `201`, returns the plaintext `key` once. Max 10 active keys, then `429 api_key_limit_reached`. |
| `GET` | `/v1/workspaces/{workspace_id}/api-keys` | Lists keys (display prefix only, never the secret or hash). Revoked keys included. |
| `DELETE` | `/v1/workspaces/{workspace_id}/api-keys/{key_id}` | `204`. Soft-revokes the key; the row is kept for audit. |

**Copy it now**

The plaintext key appears exactly once, at creation. Store it in your secret manager immediately. If you lose it, revoke it and create a new one.

## What a key lets you do

A workspace key enables three things:

1. **Provision pre-claimed forms.** Send `Authorization: Bearer lfk_...` on `POST /v1/forms` and the form is born `claimed` in the key's workspace, skipping the claim step entirely. See [Provisioning](/docs/forms/provisioning#keyed-workspace-api-key).
2. **Manage forms.** `GET` and `PATCH /v1/forms/{form_id}` and `resend-verification` accept the workspace key in place of a signed-in owner. Management applies to claimed forms only.
3. **Submit server-side.** For a form in `api_key` submission mode, server-side requests must carry the key. See [Securing your endpoints](/docs/forms/securing-your-endpoints).

## What a key cannot do

- Keys do **not** authorize dashboard reads (listing submissions, workspaces, projects). Those use your signed-in session.
- There is **no per-form secret**. The workspace key, or a signed-in owner, is the only programmatic path to a form.
- Unknown and revoked keys both return the same `401 invalid_api_key`, so a probe cannot tell a wrong key from a revoked one.

**Server-side only**

An `lfk_` key is a secret. Never embed it in a browser bundle, a mobile app, or any client a user can inspect. Browser forms are secured by origin, not by keys. See [Securing your endpoints](/docs/forms/securing-your-endpoints).

Next: [Securing your endpoints](/docs/forms/securing-your-endpoints).