Create and manage API keys

Create, scope, and revoke workspace API keys (access tokens) for the Lovable API, and set per-key credit limits.

API keys (called access tokens in settings) authenticate requests to the Lovable API. Each key belongs to one workspace and can only access that workspace’s projects and data. The public API manages and deploys existing projects, and its current endpoints, including deployment builds, do not consume AI build credits.

Creating and managing keys requires a Business or Enterprise plan, and an owner or admin role in the workspace.

Create an API key

Each key gets its own name, scopes, expiry, and optional spending cap, so give each integration its own key.

1. Open the Access tokens settings

   Go to Settings → Access tokens and click New API key.

2. Name the key

   Enter a Key name that helps you recognize the key later, for example CI/CD pipeline or Zapier. The name is visible to workspace admins and owners.

3. Set a credit limit (optional)

   Set a Credit limit to cap how many AI build credits requests using this key can spend each calendar month. The cap resets at 00:00 UTC on the first day of each month. Leave it blank for no limit.

4. Choose an expiration

   Choose an Expiration: 7, 30, 60, 90, or 180 days, 1 year, or Never. “Never” works for long-lived service integrations, but rotating keys regularly is safer.

5. Grant access

   Under Access, choose None, Read, or Read & write for each resource. You must grant at least one:

   • Projects: read and modify projects settings, delete projects, publish projects, and read project security scans in this workspace.
   • Workspace: list projects, and read workspace details, members, groups, security insights, and analytics.

   The Read only and Full access presets fill in both resources at once.

6. Create and copy the key

   Click Create, then copy the key value.

The secret value is shown only once, right after the key is created. Copy it and store it somewhere safe before leaving the page. If you lose it, you need to create a new key.

Use the key

Send the key in the Lovable-API-Key header on every request:

curl https://api.lovable.dev/v1/workspaces \
  -H "Lovable-API-Key: lov_YOUR_KEY" \
  -H "Lovable-Version: 2026-09-11" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json"

Manage existing keys

The Access tokens page lists every key in the workspace with who created it, when it was created and last used, and its credit usage. Select a key to see its details, including its scopes, expiry, and credit limit.

• Change the credit limit: open the key’s menu and click Edit credit limit. You can raise, lower, or remove the cap at any time.
• Revoke a key: open the key’s menu and click Revoke key, then confirm. Revocation is permanent and normally takes effect immediately, but allow a brief propagation delay. It does not cancel work already accepted. Anything still using the key loses access.

Scopes and expiry are fixed when the key is created. To change them, create a new key and revoke the old one.

Keep keys safe

Keep the following in mind:

• Store keys in a secret manager or environment variable, never in code or version control.
• Grant only the scopes each key needs, and prefer an expiry date over “Never.”
• Give each integration its own key, so you can revoke one without breaking the others.
• Lovable partners with GitHub secret scanning: when GitHub secret scanning detects and reports an exposed supported Lovable API key (keys start with lov_), Lovable revokes it automatically and sends an email notification. Treat a key exposed anywhere else as compromised and revoke it yourself.

When storing a key as a project secret, do not name it LOVABLE_API_KEY. Lovable creates and manages a secret with that exact name in each project, and names starting with LOVABLE_ are reserved. Pick a different name, such as LOV_PUBLIC_API_KEY.

FAQ

Who can create and see API keys?

Workspace owners and admins on Business and Enterprise plans. They see every key in the workspace, including keys created by others, but not a key’s secret value.

Can I see the secret value of a key again?

No. The secret is shown once, when the key is created. If you lose it, create a new key and revoke the old one.

What happens when a key expires?

Requests using the key start failing. Expiry does not delete the key from the list, so you can see what expired, but you need to create a new key to restore access.

What does the credit limit do?

It caps how many AI build credits requests authenticated with that key can spend each calendar month. The cap resets at 00:00 UTC on the first day of each month, independently of your subscription renewal date. The API currently manages and deploys existing projects and does not expose AI project creation or editing, so no current endpoint spends AI build credits. Deployment builds through the publish endpoint do not spend them either. When the cap is reached, requests that would spend credits fail until the next month starts or until you raise the limit. Requests that do not spend credits are not affected by the cap.

Is revoking a key reversible?

No. Revoking is permanent and normally takes effect immediately, though a brief propagation delay is possible. Create a new key if you need access again.