> ## Documentation Index
> Fetch the complete documentation index at: https://leadping.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate API Requests

> Choose and protect the correct Leadping user token, agent token, organization API key, or source key.

Send Leadping credentials in the `Authorization` header with the Bearer scheme:

```http theme={null}
Authorization: Bearer <credential>
```

## Choose a credential

| Credential                | Format                     | Use                                                   |
| ------------------------- | -------------------------- | ----------------------------------------------------- |
| User access token         | Issued to a signed-in user | Requests performed as that Leadping user              |
| WorkOS agent access token | Short-lived token          | User-approved agent automation                        |
| Organization API key      | `sk_...`                   | Services and integrations acting for one organization |
| Source key                | `lp_src_...`               | External lead ingestion only                          |

Do not interchange these credentials. In particular, a source key cannot access account, organization, user, analytics, setup, or other non-ingestion operations.

## User access

Use a Leadping user access token only when the application operates as a signed-in user.

Generated SDKs do not manage login, refresh, storage, or logout. Your application must obtain the token and attach it to the request adapter.

## Agent access

Leadping supports WorkOS AuthKit Agent Registration with the `service_auth` identity type. The flow requires user approval:

1. Register the agent with the user's email address.
2. Send the user to the WorkOS verification link.
3. Complete the claim flow with the code shown to the signed-in user.
4. Exchange the agent assertion for a short-lived access token.
5. Send that token to Leadping as a Bearer credential.

The agent remains limited by the approved user's organization membership, roles, and permissions.

Use [Leadping agent authentication](https://leadping.ai/auth.md) and the discovery metadata below for current endpoints and request bodies. Store long-lived assertions and refresh tokens in an operating-system secret store. Do not persist short-lived access tokens unnecessarily.

## Organization services

Use an organization API key for a conventional server integration that does not use Agent Registration.

1. Open [Leadping API Keys](https://leadping.ai/api-keys).
2. Sign in and select the organization.
3. Create a key and choose an expiration.
4. Store the value immediately; Leadping displays the full key once.

```http theme={null}
Authorization: Bearer sk_example
```

## Source intake

External posting systems use the key assigned to their source:

```http theme={null}
POST https://api.leadping.ai/leads/intake
Authorization: Bearer lp_src_example
Content-Type: application/json
```

Source keys authorize only:

* `POST /leads`
* `POST /leads/intake`

See [Send Leads with the Intake API](/docs/sending-leads-to-leadping) for payload and validation requirements.

## Discovery metadata

* [Agent authentication guide](https://leadping.ai/auth.md)
* [Protected resource metadata](https://leadping.ai/.well-known/oauth-protected-resource)
* [API protected resource metadata](https://api.leadping.ai/.well-known/oauth-protected-resource)
* [Authorization server metadata](https://leadping.ai/.well-known/oauth-authorization-server)
* [OpenID Connect metadata](https://leadping.ai/.well-known/openid-configuration)
* [OpenAPI specification](https://leadping.ai/docs/openapi.json)

A `401 Unauthorized` response may identify the applicable resource metadata:

```http theme={null}
WWW-Authenticate: Bearer resource_metadata="https://api.leadping.ai/.well-known/oauth-protected-resource"
```

## Protect credentials

* Store credentials outside source code.
* Transmit them only over HTTPS.
* Never write them to logs, URLs, lead metadata, or error messages.
* Scope each credential to the required organization and operation.
* Rotate exposed credentials and revoke credentials no longer in use.
* Keep SDK credential storage and refresh logic in your application infrastructure.

Continue with the [SDK overview](/docs/sdks/overview), [API Reference](/docs/api-reference), and [rate-limit guidance](/docs/rate-limits).