# Authentication

Send an API key in X-API-Key, or as Authorization: Bearer la_… when a client can only send bearer tokens (for example Codex). OAuth access tokens also use Authorization: Bearer. Send one credential only. Do not put credentials in URLs or logs.

OAuth: clients register themselves with LeadsAgent's authorization server (Client ID Metadata Documents or Dynamic Client Registration). You do not need a client ID. The client opens a LeadsAgent page; sign in and approve access.

API keys default to 90-day expiry. Choose leads:read to read tasks, results and account limits. Choose leads:write to also start tasks, reply, cancel, run tools and share results. Write permission also includes read.

Key limits can cap leads per task (1–5,000), requests per minute (1–60) and task submissions per minute (1–10). These are restrictions. They do not increase plan credits. Default limits are 60 authenticated requests and 10 task submissions per minute. Account counters are per backend process; configured key limits use shared storage.

Create and revoke keys in [Developer settings](https://leadsagent.io/dashboard/connectors/api-keys). Manage OAuth connections from the Connectors page. Key revocation applies immediately in the current worker; another worker can retain a cached key for up to 30 seconds.

[All documentation](https://leadsagent.io/documentation/quickstart)
[OpenAPI](https://leadsagent.io/documentation/openapi.json)