Skip to main content
Lehar supports two credential types on the same API. Pick based on the caller. A login session may also be presented as the myna_session HttpOnly cookie set by POST /auth/login; the header wins over the cookie.
Session creation requires a bearer login session, not an API key. POST /sessions attaches the session to the logged-in user, so an API key alone returns 400. Everything else (agents, campaigns, workspace, history) accepts an API key.

​
Scopes

API keys carry scopes. Requests without the required scope return 403.

​
Get a key

Create a key in the dashboard, or via the API with an existing api_keys:write key:
The raw key is returned once — store it in a secrets manager.
You can only grant a new key scopes your current credential already holds. Requesting a broader scope returns 403 and creates nothing.

​
Rotate a key

  1. Create a new key (above) and deploy it.
  2. Revoke the old key:

​
Security notes

  • Keys are stored as hashes only and are never logged.
  • Participant tokens are returned only when a session is created — never in list/get responses.
  • Tenant isolation is enforced on every query by workspace.
  • Key revocation takes effect immediately.