Create and manage API keys

1. 1

   Open Workspace settings, go to API keys & OAuth, select Workspace access tokens, and click New API key.

   This opens the configuration screen to generate a new credential for your integration.

2. 2

   Enter a clear Key name that identifies the service or integration using it.

   Descriptive names help team admins recognize which tool owns the key later.

3. 3

   Optionally set a monthly credit limit and choose an expiration timeframe.

   Limits prevent unexpected usage spikes, and setting an expiration date reduces security risks if a key is leaked.

4. 4

   Choose access permissions for Projects and Workspace, granting only Read or Read & write where needed.

   Limiting permissions ensures the key only accesses the exact data and actions your tool needs.

5. 5

   Optionally upload a CSV file of approved IP addresses or network ranges.

   Restricting the key ensures calls are rejected if they do not originate from your approved servers.

6. 6

   Click Create API key and copy the displayed key value into a secure storage location immediately.

   Lovable displays the secret token only once, and you cannot view it again after leaving the screen.

Create a backend endpoint that connects to the Lovable API at https://api.lovable.dev/v1/workspaces using the secret named LOV_PUBLIC_API_KEY with headers Lovable-API-Key and Lovable-Version: 2026-09-11, and display our workspace information and project list on an admin page.

API key

A unique secret password that allows external software to communicate with and control your Lovable workspace.

IP allowlist

A security list of approved internet addresses; any connection coming from an address not on the list is blocked.

CIDR notation

A standard format for writing a whole range of consecutive internet addresses together.

Scope

The specific set of permissions granted to a key, determining whether it can view or edit specific workspace resources.

• Leaving the key creation screen without copying the secret token, forcing you to delete it and create a new one.
• Naming a project secret LOVABLE_API_KEY, which is a reserved system name that cannot be overwritten (use a name like LOV_PUBLIC_API_KEY instead).
• Uploading an IP allowlist without at least one IPv4 address, which causes requests to fail because the Lovable API answers over IPv4.
• Failing to add Lovable connector gateway IP ranges to your allowlist when using the key with the Lovable API connector.
• Attempting to generate workspace API keys on Free or Pro plans, which only support OAuth clients for user logins.