# Key

From the Lero API docs: https://lero.studio/docs/en#chave. Everything in one file: https://lero.studio/docs/en/llms-full.txt.

Every route needs the key in the `Authorization: Bearer <your key>` header (or in the `X-Api-Key` header). The key starts with `lero_` and shows in full only once, when you create it. After that, the app shows only the last 4 characters.

- Use the key only on your server. Never in the browser, in a mobile app or in a repository: whoever has the key spends your credits.
- Each key can have a name, a monthly credit cap and an expiry (1, 7, 30 or 90 days, or never).
- Leaked? Revoke the key in the app. It stops at once, and you create another one.
- Up to 10 active keys per account.