API tokens

An API token lets your own code, integrations (Zapier, Make, n8n) and MCP clients call the Lantfly API (https://lantfly.com/api/v3) as your account. You manage tokens on API & integrations: user menu → API tokens, or https://lantfly.com/settings/api.

For how to send a token, see Authentication.

Create a token

1. Open API & integrations → New token.

2. Fill in the form:

   Field	What it does
   Name	A label, for example n8n production
   Expires in (days)	Optional. Empty means the token never expires
   Access	Full access, or Read-only (GET requests only)
   Limit to actors (optional)	Restrict the token to some actors (up to 50)
   Limit token permissions	Tick only the permissions the token needs (list below)

3. Click Create token.

4. Copy the token now. It is shown once, in the banner Your new token … — copy it now, it is not shown again. Lantfly stores only a hash of it, so a lost token cannot be shown again. Regenerate it or create a new one.

You also get a security email naming the new token, the account and the expiry date.

info

Tokens can be created, renamed, regenerated and revoked only from the dashboard. Every token-management endpoint (/api/v3/me/tokens*) answers 403 session_required when called with an API token, even a full-access one. A leaked token therefore cannot create more tokens.

The IDs card on the same page shows your User ID (or Organization ID) and your Namespace, with copy buttons. Support may ask for them.

Limit what a token can do

The three kinds of limits can be combined.

Limit	Effect
Read-only	Only GET and HEAD requests. Anything else answers 403
Limit to actors	The token can read those actors and their builds and start runs of them. It can read, log and abort their runs, and only read the default storages of those runs. Lists, actor versions (environment variables), tasks, schedules, webhooks and billing answer 403
Limit token permissions	The token can do only what is ticked. Routes no permission covers (billing, team, token management) are refused. GET /api/v3/me always works

A request outside the token's permissions answers 403 with code insufficient_permissions and the missing permission in details.permission. See Errors.

Token permissions

This is the list returned by GET /api/v3/me/token-permissions:

Group	Key	Allows
Actors	actors.read	View actors, their versions and builds
	actors.run	Run actors (also standby and the call-actor MCP tool)
	actors.build	Build actors and abort builds
	actors.write	Create, change and delete actors
Runs	runs.read	View runs, their logs and default storages
	runs.write	Abort, resurrect, reboot and change runs
Tasks	tasks.read	View tasks and their input
	tasks.run	Run tasks
	tasks.write	Create, change and delete tasks
Schedules	schedules.read	View schedules and their log
	schedules.write	Create, change and delete schedules
Storages	storages.read	Read datasets, key-value stores and request queues
	storages.write	Create, write and delete storages
Webhooks	webhooks.read	View webhooks and their dispatches
	webhooks.write	Create, change, test and delete webhooks
Social listening	listening.read	View social listening projects, mentions, analytics, creators, campaigns and reports
	listening.write	Create and change listening projects, sources, campaigns, alerts and reports; collect now

tip

The MCP server needs no special permission: each MCP tool shows up only when the token has the permission that tool needs. For example, a token with only listening.read still works with MCP for listening. See MCP permissions.

Use a token

Check which account a token acts for

curl https://lantfly.com/api/v3/me \
  -H "Authorization: Bearer $LANTFLY_TOKEN"

The token list shows each token's name, when it was last used, when it expires and badges such as read-only, N actors or N permissions.

Rename, regenerate, revoke

Action	Effect
Rename	Changes the label only
Regenerate	A new secret with the same name, limits and expiry. The current secret stops working at once
Revoke	The token stops working at once. Anything that uses it gets 401 from then on

Expired tokens are deleted automatically. Tokens without an expiry stay until you revoke them, however long they go unused.

Organization tokens

If you create a token while working in an organization (see Organizations), it belongs to the organization:

• Runs, storages and billing are the organization's.
• It carries the current role of the member who created it. If their role changes, the token changes with it.
• It stops working when its creator leaves or is removed from the organization.
• Creating, renaming and regenerating need the tokens.create permission. Only the creator can rename or regenerate it.
• Each member can revoke their own tokens. Owners, admins and members with team.manage see everyone's tokens and can revoke them, but cannot regenerate them.
• It can never reach the creator's personal settings. me/profile, me/avatar, me/preferences, me/security, me/session-lifetime and me/sessions* answer 403.

You can also use a personal token and act for an organization by sending its ID in the X-Lantfly-Account header. See Organizations in the API.

Connected apps (OAuth)

AI apps such as Claude, ChatGPT, Cursor or VS Code can connect to the Lantfly MCP server with OAuth instead of a pasted token. See MCP OAuth.

When an app connects, you choose the account it acts for (your own, or an organization where you may create tokens) and whether it is read-only. You get a security email An AI app was connected.

Manage connected apps on AI & MCP (https://lantfly.com/ai) → Connected apps. The list shows each app, the account it acts for, whether it is read-only and when it was last used. Disconnecting an app stops its tokens at once.

Detail	Value
App access token lifetime	1 hour (refreshed automatically)
Refresh token lifetime	30 days
Listed under API tokens?	No, only under Connected apps
Ends when	You disconnect it, change or reset your password, or leave the organization it acts for

API equivalents (dashboard session only): GET /api/v3/me/oauth-grants and DELETE /api/v3/me/oauth-grants/{id}.