Skip to content
Leadbase

API keys and OAuth

Create workspace-scoped API keys or authorize a compatible client with OAuth.

API key

Open Getting Started, select the intended workspace and create a named API key. Copy the secret when it is shown: the key list only displays a prefix afterward. Store it in your application's secret configuration.

bash
curl https://www.leadbase.io/api/v1/operations/tools.list \  -H "x-api-key: $LEADBASE_API_KEY" \  -H 'Content-Type: application/json' \  -d '{"query":"search"}'

This request discovers tools; it does not execute paid research. The API also accepts a Leadbase key as Authorization: Bearer <key>. Never place keys in browser code, URLs, public repositories or prompts shared with other users.

A key belongs to the workspace selected when it was created. Changing the active workspace in the app does not move an existing key. Membership is rechecked on requests. Revoke unused or exposed keys in Getting Started and update your integration with a replacement.

OAuth

For compatible MCP clients, prefer their native OAuth connection. The MCP resource is https://www.leadbase.io/api/mcp; the HTTP API resource is https://www.leadbase.io/api. OAuth tokens are audience-bound, so a token issued for one resource cannot simply be reused for the other.

Resource metadata is published at /.well-known/oauth-protected-resource/api and /.well-known/oauth-protected-resource/api/mcp. mcp:read permits reads; mcp:write permits authorized writes and metered operations. Each request still checks membership and applicable policy.

Rate limits

API keys currently allow 600 requests per 60 seconds per key. This is a request limit, not a promise of 600 simultaneous research jobs. Workflow admission, available credits and individual tools can impose additional limits. Treat 429 as a signal to back off, not to create more keys or duplicate jobs.