Security
Authentication
Every API request uses a Bearer token. Tokens belong to a LeadsFriday account and use that account's credits.
Bearer authentication
Include the token in the Authorization header for every protected request.
Authorization: Bearer lf_live_your_api_token
Keep tokens server-side
Never embed a token in browser code, mobile apps, public repositories, or shared screenshots.
Token lifecycle
CreateGenerate tokens from API Keys in your dashboard.
RotateRotate immediately if a token may have been exposed.
RevokeRevocation takes effect immediately and cannot be undone.