Authentication

Every request carries a personal API key as a bearer token. The key acts as you.

API keys#

Create a key in Settings, Integrations, API keys (Closer and Veteran plans). Choose whether it may write. Leasync shows the key once; copy it somewhere safe. Keys start with lsk_live_.

Send it as a bearer token on every request to https://www.leasync.ai/api/v1.

Headerhttp

Authorization: Bearer lsk_live_...

Every request is exchanged for a short-lived session for the key's owner, so the database enforces the same row-level rules it enforces for you in the app. Revoke a key from the same settings card; it stops working immediately. Keys also stop working if the owner leaves the workspace.

Check a key#

Who am I#

GET/me

Returns the user and workspace the key acts as, the member role, and the key's scopes. A good first call to confirm a key works.

Request

bash

curl https://www.leasync.ai/api/v1/me \
  -H "Authorization: Bearer lsk_live_..."

Response

json

{
  "data": {
    "user": {
      "id": "a1c2d3e4-…",
      "email": "you@brokerage.com"
    },
    "organization": {
      "id": "0f9e8d7c-…",
      "name": "Your Brokerage",
      "tier": "closer"
    },
    "role": "agent",
    "scopes": [
      "read",
      "write"
    ],
    "key_prefix": "lsk_live_a8f3",
    "auth": "api_key"
  }
}

A key with no write scope answers "scopes": ["read"]. See Scopes & permissions.

Security model#

Keys act as their owner.Each request is turned into a ten-minute session for you, and the database applies your row-level permissions: private modules, sharing, admin rights, and hidden pages all carry over. There is no "API user" with wider access.
Only a hash is stored. Leasync keeps a SHA-256 of the key, never the key itself. Lose it and you create a new one.
Keys are personal.Even workspace admins cannot see or use a teammate's keys. Removing someone from the workspace disables their keys.
Everything is attributed.Writes over the API show on the record timeline as you, tagged as coming from the API with the key's prefix.
Treat a key like a password. Keep it in environment variables or a secrets manager, never in client-side code, and revoke it the moment you think it leaked.

Questions or a missing endpoint? Email mason@leasync.ai. See what else is new on the changelog.