Manage API keys

Create and revoke credentials for programmatic workspace administration.

AdminsReviewed October 24, 2026

On this page

Open Settings → API keys in the workspace you want to manage. Only active workspace admins can create and manage these credentials.

API keys let your own software use Lira’s supported programmatic admin capabilities. They do not create additional permissions, workspace members, or usage allowance. Your current role, the workspace’s privacy settings, scenario ownership, and retention rules still apply.

The API keys page shows fictional CRM automation and Weekly reporting entries, Workspace access, last-used dates, Revoke actions, search, and Create key; no secrets are displayed. — Example key metadata: review access and usage without exposing credentials.

Create and store a key

Choose Create key and give the integration a recognizable Key name. Select Create key in the dialog, then Copy key and store the value in your server or secret manager. Choose I’ve saved it when finished. The full secret is shown only once; Lira cannot display it again later.

The unsubmitted Create API key dialog shows a Key name field with a Production integration placeholder, Cancel, and Create key. — Example setup: name the integration before creating its credential.

Never put a key in a shared practice URL, browser code, email, screenshot, or AI chat. Use the authentication mechanism your integration supports and keep credentials outside prompts and source control.

Choose the right connection

For an interactive AI agent, use Integrations → AI agents and the client’s OAuth sign-in. You do not need to create an API key or paste one into the conversation.

For your own programmatic integration, a Workspace key supports the registered admin tools through the tools API and the existing external-practice REST API. The tools API has a capability catalog at GET /api/v1/tools and executes a named capability at POST /api/v1/tools/{name}. It does not add unsupported dashboard actions or change the OAuth-only MCP connection. See sharing a practice link for the reusable-link workflow.

Earlier keys marked Sharing only keep that restriction. They can use the external-practice API, but do not gain access to the wider admin tools.

Use the tools API

Send the key in the Authorization header to retrieve the supported tool names and their input schemas:

GET /api/v1/tools
Authorization: Bearer <workspace-api-key>

Call a returned tool by its exact name. For example, this read confirms the connected workspace:

POST /api/v1/tools/lira_get_context
Authorization: Bearer <workspace-api-key>
Content-Type: application/json

{}

The request body is the tool’s plain JSON arguments, not a JSON-RPC envelope. Follow the returned input schema. Writes require a UUID idempotencyKey in that JSON; reads do not. Reuse the same key and arguments when recovering an uncertain write instead of creating a second operation.

Existing external-practice REST endpoints use their documented Idempotency-Key header instead. The tools API accepts bodies up to 1 MiB and limits each key to 120 requests per minute. Handle authorization, validation, conflict, and rate-limit errors before retrying.

The protected recording and certificate download URLs returned by the tools accept the same workspace key in their Authorization header. Each download rechecks role, privacy, consent, and retention. Retrieving a descriptor never publishes private content. The /mcp protocol endpoint itself continues to require OAuth.

Understand the access boundary

Keys are tied to their issuing admin and workspace. They stop working when revoked or when that admin no longer has active Admin access. Creating a key never bypasses a private scenario’s ownership, makes an unshared result available, or publishes a recording.

The supported admin tools can work with permitted scenarios, shared knowledge, assignments, submitted results, reports, and existing certificates. They do not provide member-role administration, workspace privacy changes, live-call control, or manual score or certificate issuance.

External practice still requires approved scenario versions and a finite workspace allowance. A key cannot add allocation or remove a link’s limits.

Revoke or replace a key

Return to Settings → API keys, choose Revoke for the key, and confirm Revoke key when its integration is retired or its secret may have been exposed. Revocation stops further authenticated requests. It does not delete scenarios, reset link usage, or revoke existing public practice links.

To replace a key, create a new one, update your integration’s secret, verify an authorized request, and revoke the old key. If a secret was exposed, revoke it immediately rather than waiting for the replacement to be deployed.