API keys
A personal API key lets your own tools act as you in LEMA Chat. It's how you connect an external client — Claude Code, Codex, a script — to your workspace without sharing your login.
Creating a key
- Open Settings (the ⚙ button, bottom-left).
- Go to API keys.
- Create a key. The full secret — it looks like
lcak_…— is shown once. Copy it now; you won't be able to see it again.
Only a fingerprint of the key (a hash plus the last four characters) is stored, so LEMA Chat itself can't reveal your key back to you later.
What a key can (and can't) do
A key authenticates as its owner. That means:
- It has exactly your live memberships, roles, and clearance — resolved fresh on every request. A key can never do more than you can.
- If your access changes, or you revoke the key, that takes effect immediately.
- You can pin a key to a single workspace so it can't touch your others.
This is the anti-escalation rule from Groups & roles, applied to keys: a key is a capability-scoped stand-in for you, not a superuser token.
Using a key
The most common use is connecting LEMA Chat as an MCP server to your tools — see LEMA Chat as an MCP server. You pass the key as a bearer token:
Authorization: Bearer lcak_...Treat it like a password
Anyone holding your key can act as you within its scope. Don't paste it into shared files or commit it to a repo. Revoke and reissue if it leaks.