API keys (called access tokens in settings) authenticate requests to the RShift Sites API. You also use one to set up the RShift Sites API connector, which lets an app you build with RShift Sites call the API. Each key belongs to one workspace and can only access that workspace’s projects and data. The public API manages and deploys existing projects, and its current endpoints, including deployment builds, do not consume AI build credits.
Creating and managing keys requires a Business or Enterprise plan, and an owner or admin role in the workspace.
Create an API key
Each key gets its own name, scopes, expiry, and optional spending cap, so give each integration its own key.
Open the Access tokens settings
Go to Settings → Access tokens and click New API key.
Name the key
Enter a Key name that helps you recognize the key later, for example CI/CD pipeline or Zapier. The name is visible to workspace admins and owners.
Set a credit limit (optional)
Set a Credit limit to cap how many AI build credits requests using this key can spend each calendar month. The cap resets at 00:00 UTC on the first day of each month. Leave it blank for no limit.
Choose an expiration
Choose an Expiration: 7, 30, 60, 90, or 180 days, 1 year, or Never. “Never” works for long-lived service integrations, but rotating keys regularly is safer.
Grant access
Under Access, choose None, Read, or Read & write for each resource. You must grant at least one:
- Projects: read and modify projects settings, delete projects, publish projects, and read project security scans in this workspace.
- Workspace: list projects, and read workspace details, members, groups, security insights, and analytics.
The Read only and Full access presets fill in both resources at once.
Create and copy the key
Click Create, then copy the key value.
Use the key
Send the key in the Lovable-API-Key header on every request:
curl https://api.lovable.dev/v1/workspaces \
-H "Lovable-API-Key: lov_YOUR_KEY" \
-H "Lovable-Version: 2026-09-11" \
-H "Accept: application/json" \
-H "Content-Type: application/json"Manage existing keys
The Access tokens page lists every key in the workspace with who created it, when it was created and last used, and its credit usage. Select a key to see its details, including its scopes, expiry, and credit limit.
- Change the credit limit: open the key’s menu and click Edit credit limit. You can raise, lower, or remove the cap at any time.
- Revoke a key: open the key’s menu and click Revoke key, then confirm. Revocation is permanent and normally takes effect immediately, but allow a brief propagation delay. It does not cancel work already accepted. Anything still using the key loses access.
Scopes and expiry are fixed when the key is created. To change them, create a new key and revoke the old one.
Keep keys safe
Keep the following in mind:
- Store keys in a secret manager or environment variable, never in code or version control.
- Grant only the scopes each key needs, and prefer an expiry date over “Never.”
- Give each integration its own key, so you can revoke one without breaking the others.
- RShift Sites partners with GitHub secret scanning: when GitHub secret scanning detects and reports an exposed supported RShift Sites API key (keys start with
lov_), RShift Sites revokes it automatically and sends an email notification. Treat a key exposed anywhere else as compromised and revoke it yourself.
FAQ
Who can create and see API keys?
Workspace owners and admins on Business and Enterprise plans. They see every key in the workspace, including keys created by others, but not a key’s secret value.
Can I see the secret value of a key again?
No. The secret is shown once, when the key is created. If you lose it, create a new key and revoke the old one.
What happens when a key expires?
Requests using the key start failing. Expiry does not delete the key from the list, so you can see what expired, but you need to create a new key to restore access.
What does the credit limit do?
It caps how many AI build credits requests authenticated with that key can spend each calendar month. The cap resets at 00:00 UTC on the first day of each month, independently of your subscription renewal date. The API currently manages and deploys existing projects and does not expose AI project creation or editing, so no current endpoint spends AI build credits. Deployment builds through the publish endpoint do not spend them either. When the cap is reached, requests that would spend credits fail until the next month starts or until you raise the limit. Requests that do not spend credits are not affected by the cap.
Is revoking a key reversible?
No. Revoking is permanent and normally takes effect immediately, though a brief propagation delay is possible. Create a new key if you need access again.