Create and manage API keys

1. 1

   Go to your Lovable settings, find 'Access tokens', and click 'New API key'.

   This is where you start the process of creating a new key for your integrations.

2. 2

   Give your new key a clear name, like 'Zapier connection' or 'CI/CD pipeline'.

   A good name helps you remember what each key is for, especially if you have many.

3. 3

   Optionally, set a monthly spending limit for AI credits for this key.

   This prevents unexpected costs if the connected tool uses a lot of AI features, and it resets every month.

4. 4

   Choose how long the key should work before it expires.

   Setting an expiration date is safer, as it means the key won't work forever if it gets lost or stolen.

5. 5

   Decide what the key can do: 'None', 'Read', or 'Read & write' for your projects and workspace information.

   This limits what an external tool can access or change in your Lovable account, improving security.

6. 6

   Click 'Create' and immediately copy the secret key value that appears.

   The key is shown only once, so you must save it right away; if you lose it, you'll have to make a new one.

7. 7

   Use the copied key by including it in the 'Lovable-API-Key' header when making requests to the Lovable API.

   This is how your external tools prove they are allowed to access your Lovable workspace.

I need to create a new API key for my Lovable workspace. I want to connect it to an external tool that needs to read and write project settings. I'd like it to expire in 90 days and have a monthly AI credit limit of 100 credits. Please guide me through the steps to set this up.

API key

A secret code that acts like a password for a specific application or service to talk to Lovable. It identifies the application and grants it permission to do certain things.

Access tokens

Another name for API keys in Lovable's settings. They are digital passes that grant access to your Lovable workspace.

Workspace

Your personal or team area within Lovable where your projects and data are stored.

Scopes

The specific permissions or actions an API key is allowed to perform, such as 'read projects' or 'write project settings'.

Revoke

To cancel or disable an API key permanently, making it unusable for any future requests.

Credit limit

A maximum amount of AI build credits that an API key can spend within a calendar month.

CI/CD pipeline

A set of automated steps that help developers build, test, and deploy their software more efficiently and frequently.

Environment variable

A named value stored outside of your code that can be accessed by your programs, often used for sensitive information like API keys.

Secret manager

A tool or service designed to securely store and manage sensitive information like API keys, passwords, and other credentials.

• Never share your API key or put it directly into your code or public version control (like GitHub).
• If you lose the secret key value after creation, you cannot retrieve it; you must create a new key.
• Using a single key for multiple integrations makes it harder to revoke access for just one tool without affecting others.
• Forgetting to set an expiration date for keys used by temporary integrations can leave a security risk open longer than needed.
• Naming a project secret 'LOVABLE_API_KEY' will conflict with Lovable's internal system; use a different name.