API keys allow CI pipelines, external servers, and automated workflows to interact with LeafCloud without interactive browser logins.

Create an API key

Generate a new key using leaf keys create:

leaf keys create --name "ci-deployer" --can deploy --site "my-cool-project" --expires 90d

Output:

API key created. Copy this secret now; it will not be shown again:
leaf_pat_a1b2c3d4e5f67890123456789abcdef0

Important: The key secret is displayed only once. Store it in a secure password manager or CI secret vault immediately.

Key options

• --name <name>: A human-readable label identifying the key’s purpose (required).
• --can <deploy|read>: Permission scope. deploy allows site uploads; read grants read-only access (required).
• --site <site>: Restricts the key to deploying only to the specified site.
• --expires <duration>: Sets the key’s validity window. Must be between 1d and 365d (default: 90d).

List API keys

To view existing keys without revealing their secrets:

leaf keys list

Output:

NAME                     SCOPES               ID
ci-deployer              ["deploy"]           key_9f8e7d6c
monitoring-bot           ["read"]             key_1a2b3c4d

With --json:

leaf keys list --json

{"schema":1,"type":"keys","data":{"id":"key_9f8e7d6c","name":"ci-deployer","scopes":["deploy"]}}
{"schema":1,"type":"keys","data":{"id":"key_1a2b3c4d","name":"monitoring-bot","scopes":["read"]}}

Revoke an API key

Revoke a key immediately using its key ID:

leaf keys revoke key_9f8e7d6c

Output:

Revoked API key key_9f8e7d6c.