How to Authenticate Leadping API Requests

The Leadping API accepts four credential forms in the Authorization header with the Bearer scheme:

Credential	Header	Use it for
Leadping user access token	`Authorization: Bearer <leadping_user_access_token>`	First-party user-scoped API operations
WorkOS agent access token	`Authorization: Bearer <workos_agent_access_token>`	User-approved agent automation with a short-lived token
Organization API key	`Authorization: Bearer sk_...`	Agent, service, and integration access to an organization
Source key	`Authorization: Bearer lp_src_...`	Lead ingestion only from an approved source

For autonomous agents, prefer WorkOS Agent Registration. For conventional server integrations, use a Leadping organization API key. A lp_src_ source key is not an SDK-default, agent, service, account, or organization API credential; it is only for approved source lead ingestion.

Not sure which path applies? Start with Build with Leadping.

Discovery

Machine-readable authentication discovery is available at:

Agent authentication guide: https://leadping.ai/auth.md
Protected resource metadata: https://leadping.ai/.well-known/oauth-protected-resource
API protected resource metadata: https://api.leadping.ai/.well-known/oauth-protected-resource
Authorization server metadata: https://leadping.ai/.well-known/oauth-authorization-server
OpenID Connect metadata: https://leadping.ai/.well-known/openid-configuration
OpenAPI reference: https://leadping.ai/docs/openapi.json

When the API returns 401 Unauthorized, it can include a resource metadata pointer:

WWW-Authenticate: Bearer resource_metadata="https://api.leadping.ai/.well-known/oauth-protected-resource"

Agent clients should follow that metadata and https://leadping.ai/auth.md before attempting authenticated calls.

User-scoped access

Signed-in user API calls use Leadping user access tokens. Use user-scoped tokens only when your application is operating as a signed-in Leadping user. The SDKs do not manage login, token refresh, token storage, or logout for you; attach the token in your request adapter. For token validation, use the machine-readable metadata above for the current issuer and JWKS URL.

Agent and service access

Leadping supports WorkOS AuthKit Agent Registration with the service_auth identity type. Start with https://leadping.ai/auth.md for the current registration, approval, credential exchange, refresh, and revocation instructions. The flow requires user approval: the agent registers with the user’s email address, gives the user the WorkOS verification link, and completes the claim ceremony using the code shown to the signed-in user. WorkOS then issues an agent assertion that the agent exchanges for a short-lived access token. Send that access token to Leadping with the Bearer scheme. The token remains constrained by the approved user’s organization membership, roles, and permissions. Resolve current endpoints and exact request bodies from auth.md and the linked authorization-server metadata. Store the long-lived assertion and refresh token in an operating-system secret store, never in source code or logs, and mint a fresh short-lived access token when needed. Organization API keys remain supported for services and integrations that do not use Agent Registration. To create one:

Send the user to https://leadping.ai/api-keys.
The user signs in through Leadping.
The user selects the organization the integration should access.
The user creates an organization API key and chooses an expiration.
Store the returned key securely. Leadping only shows the full key once.

Send the key on organization-scoped API requests that support organization API key access:

Authorization: Bearer sk_example

Leadping does not support anonymous agent registration. See https://leadping.ai/auth.md for supported identity types and the credential exchange flow.

Source intake

External lead submissions use a source key instead of a user token or organization API key:

POST https://api.leadping.ai/leads/intake
Authorization: Bearer lp_src_example
Content-Type: application/json

Use source keys only for approved source lead ingestion routes:

POST /leads
POST /leads/intake
GET /leads/intake

Leadping rejects lp_src_ source keys for account, organization, user, analytics, setup, and other non-ingestion API operations. For setup and validation details, see Sending Leads to Leadping.

Credential handling

Treat user tokens, agent assertions and refresh tokens, organization API keys, and source keys as secrets. Store them outside source code, transmit them only over HTTPS, rotate them after exposure, and revoke credentials that are no longer needed. WorkOS agent access tokens are short-lived and should not be persisted. The generated SDKs do not own token storage, API key storage, refresh flows, or secret rotation. Keep credentials in your application infrastructure and inject the correct Authorization header into the Kiota request adapter.

Continue building

Choose a generated client in the Leadping SDK overview.
Browse endpoint contracts and examples in the Leadping API Reference.
Implement safe throttling and retries using the API rate-limit guidance.
Verify incoming automation deliveries with Leadping webhook signature validation.

Last updated: August 17, 2026

Start Here

Build Your Workflow

Prepare for Production

Build with Leadping

Security & Trust

Policies & Legal

How to Authenticate Leadping API Requests

Discovery

User-scoped access

Agent and service access

Source intake

Credential handling

Continue building

​Discovery

​User-scoped access

​Agent and service access

​Source intake

​Credential handling

​Continue building

Discovery

User-scoped access

Agent and service access

Source intake

Credential handling

Continue building