LocalUpHelp center
EN
Help center / Developers
How-to

Create an API key

Create an API key with the right scopes, store the token safely and make your first API request.

An API key lets a program act on your account's data through the LocalUp API or the MCP server. This guide shows how to create one with only the access it needs and how to keep it safe.

Before you start:

  • API access must be enabled for your account (the API item is in the sidebar), and your role must allow managing API keys.
  • Decide what the integration needs to do — reading reviews, updating locations, connecting an AI assistant — so you can pick the minimum scopes.

Steps

  1. Open Other → API.
  2. In API keys, click Create key.
  3. Enter a clear Name that says where the key is used, for example Production · backend.
  4. Tick the Scopes the integration needs. Choose as few as possible. To connect an AI assistant through the MCP server, include mcp:connect.
  5. Click Create key in the dialog.
  6. The Save your token window shows the full token. This is the only time it is shown. Copy it and store it in a secure place, such as your password manager or your server's secret storage.
  7. Click Done.

Important: Treat the token like a password. Never put it in website code that runs in visitors' browsers and never share it by email or chat.

Check that it worked

Make a test request with the token — the Quick start block on the API screen shows an example:

curl https://<your cabinet address>/api/v1/locations \
  -H "Authorization: Bearer <your token>"

A successful response returns your locations. On the API screen, the key's Last used date updates and the call appears in Request logs.

Rotate or revoke a key

  • If the token may have leaked, or as routine hygiene, use Rotate on the key's row. A new token is shown once; the old one stops working immediately — update every integration that uses it.
  • If the key is no longer needed, use Revoke. Calls with it fail immediately. This cannot be undone.

Troubleshooting

  • "Key name is required" / "Pick at least one scope". Fill in the name and tick at least one scope.
  • Requests return 401. The token is wrong, incomplete, revoked or rotated. Check the Authorization: Bearer … header.
  • Requests return 403. The key lacks a scope the endpoint requires. The API reference lists the required scopes per endpoint; create a key with the right scopes.
  • Requests return 429. You exceeded the per-minute limit. Wait for the time in the Retry-After header.
  • I lost the token. It can't be shown again. Rotate the key to get a new token.