API Keys

API keys enable programmatic access to lnkify's GraphQL API and MCP server. Use them to automate link creation, integrate with your own applications, or let AI agents manage your shortlinks through the Model Context Protocol.

What Are API Keys For?

An API key authenticates your account for programmatic use, bypassing the need for interactive login. With an API key you can:

• Query and mutate data through the GraphQL API — create, read, update, and delete shortlinks from your own scripts and applications
• Connect to the MCP server — let AI coding assistants like Claude or opencode create and manage shortlinks on your behalf
• Integrate lnkify into CI/CD pipelines, chatbots, browser extensions, or any custom tooling

API keys have the same permissions as your user account — they can access and modify all your shortlinks and profile data.

Creating an API Key

API keys are managed from the API Keys screen:

1. Open API Keys from the dashboard sidebar (/api-keys)
2. Click Create API Key
3. Fill in the form:
   • Label — a descriptive name for the key (e.g. "CI/CD pipeline", "VS Code MCP", "My Python bot"). This helps you identify keys later.
   • Expiration date (optional) — set a date after which the key automatically becomes invalid. Leave blank for a key that never expires.
4. Click Create

Important: Save your key immediately

After creation, the full API key is shown once. Copy it and store it securely — it cannot be retrieved later. If you lose the key, you must revoke it and create a new one.

The key is displayed in a modal or inline code block. Look for the copy button to copy it to your clipboard.

Key Format

API keys follow this format:

lf_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

• lf_live_ — prefix identifying this as a live lnkify API key
• The remainder is a cryptographically random string
• Keys are case-sensitive

What the Dashboard Shows

After creation, the API Keys section in your profile lists all your keys with:

Field	Description
Label	The name you gave the key
Prefix	The first 8 characters (e.g. lf_live_a1b2...)
Last 4	The final 4 characters for identification
Last used	The date and time the key was last used for an API call
Expiry	Expiration date (or "Never" if no expiry was set)
Status	Active or Revoked

Revoking an API Key

To invalidate an API key immediately:

1. Open the API Keys screen (/api-keys)
2. Locate the key you want to revoke
3. Click the Revoke button (or trash/× icon) next to it
4. Confirm the revocation in the dialog

Immediate effect

Revocation is instant. Any application or service using the revoked key will immediately receive authentication errors. Make sure you've updated your application configuration before revoking a key.

• Revoked keys remain visible in the list with a "Revoked" status for your records
• You cannot reactivate a revoked key — create a new one instead
• Deleting a key entry from the list is not currently supported

Using an API Key

Pass your API key in one of two ways:

As an HTTP Header

x-api-key: lf_live_your_key_here

As a Bearer Token

Authorization: Bearer lf_live_your_key_here

Both methods are equivalent. Choose whichever is more convenient for your HTTP client or library.

Example: curl

curl -X POST https://your-instance.com/graphql \
  -H "Content-Type: application/json" \
  -H "x-api-key: lf_live_xxxxxxxx" \
  -d '{"query": "query { getUserInfo { email } }"}'

Example: MCP Server Connection

When configuring an AI assistant to connect to the lnkify MCP server, you'll be prompted for the API key. Paste the full key (including the lf_live_ prefix). See the MCP Connecting guide for details.

Security Best Practices

• Never commit API keys to version control — add them to .gitignore or use .env files that are excluded from your repository
• Use environment variables — store keys in process.env.LNKIFY_API_KEY or your deployment platform's secrets manager
• Create separate keys for separate purposes — use one key for your CI pipeline, another for your personal scripts, and another for MCP. This makes it easy to revoke a specific integration without disrupting others.
• Set expiration dates — for temporary integrations, set an expiry so the key auto-revokes when no longer needed
• Rotate keys periodically — create a new key, update your applications, then revoke the old key
• Revoke compromised keys immediately — if you suspect a key has been leaked, revoke it first, then investigate
• Monitor the "Last used" column — if a key you don't use shows recent activity, revoke it and investigate

Key Scoping

API keys have full account access — they can perform any action your user account can, including:

• Creating, reading, updating, and deleting shortlinks
• Performing bulk operations
• Viewing analytics data
• Managing API keys (creating and revoking other keys through the API)

There is no fine-grained key scoping (e.g. read-only keys, link-specific keys) in the current version.

Rate Limits

API calls authenticated with an API key are subject to the same rate limits as interactive usage. If you exceed the rate limit, you'll receive a 429 Too Many Requests response. See the Rate Limits documentation for details.

Next: Settings