Skip to main content
The API authenticates every request with a Bearer token in the Authorization header:
The same header works for both the REST API and the MCP endpoint.
The legacy x-api-key header is still accepted for backward compatibility. New integrations should use Authorization: Bearer.

​
Create your Token

1

Open API Tokens

Go to API Tokens in your Lev8 workspace. Sign in if prompted.
2

Create a new Token

Click Create Token. Lev8 generates a Token that starts with lev8_live_.
3

Copy it immediately

The complete Token is shown only once. Copy it now and store it in a secrets manager or your shell profile. After you close the dialog, Lev8 only displays a masked form like lev8_live_ab12cd34ef56_****.
4

Set it as an environment variable

Add this line to your ~/.zshrc, ~/.bashrc, or equivalent so it persists across terminal sessions.
Treat the complete Token as a secret. Never embed it in frontend JavaScript, mobile applications, public repositories, analytics events, or log messages.

​
Verify your Token

Run a quick credit balance check to confirm the Token works:
A successful response returns your available_credits. If you get 401, double-check that the Token is complete and active.

​
Key lifecycle

  • Tokens belong to the user who created them.
  • Revocation takes effect immediately. Repeated revocation is safe.
  • Existing Tokens cannot be recovered from the dashboard; create a replacement and rotate clients instead.
  • Multiple Tokens for the same user share the same balance and user-level concurrency allowance.

​
Authentication errors

These responses use the standard error envelope and do not expose credential records or dependency details.