---
title: "API Authentication — Lemwatch Help"
description: "Generate API keys, authenticate REST requests with bearer tokens, scope permissions, and rotate credentials safely in LemWatch."
canonical: "https://lemwatch.com/help/api-authentication"
source: "https://lemwatch.com"
---

# API Authentication

> Generate API keys, authenticate REST requests with bearer tokens, scope permissions, and rotate credentials safely in LemWatch.

## API Authentication

### Getting Your API Key (Pro Plan Required)

- Go to Settings → API

- Click "Create API Key"

- Give it a name (e.g., "CI/CD Pipeline", "Monitoring Dashboard")

- Set permissions:

- Read — Fetch site data, check results, reports

- Write — Add sites, trigger checks, update settings

- Read + Write — Full access

- Copy the key — it's only shown once!

### Using Your API Key

 Include it in the Authorization header:

### Key Management

- Rotate keys regularly — Create a new key, update your integrations, then delete the old one

- Use descriptive names — So you know which key is used where

- Minimum permissions — Only grant read access if write isn't needed

- Monitor usage — Check key usage in Settings → API → Usage

### Key Security

- Store keys in environment variables, never in code

- Never commit keys to version control

- Set IP allowlists for production keys (Enterprise)


## Related

- [Help centre](https://lemwatch.com/help)
- [API Rate Limits](https://lemwatch.com/help/api-rate-limits)
- [API Endpoints Reference](https://lemwatch.com/help/api-endpoints)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [How does API endpoint degradation alerting work?](https://lemwatch.com/help/api-endpoint-degradation)
- [What structured data does the Answers Hub use?](https://lemwatch.com/help/answers-schema-and-snippets)