Skip to main content

Authentication

Every API request must include your API key in the Authorization header.

API Base URL

All requests must be sent to the secure Bodyguard proxy: https://api.leaf7.fun
Direct access to auth.leaf7.fun is strictly prohibited and will result in a 403 Forbidden error.

Finding your API key

  1. Log in to your Leaf7 Dashboard
  2. Navigate to Settings
  3. Your API key is displayed under API Key
Automated Key Rotation: For security, your API key is automatically rotated every 7 days. You will receive an email warning 24 hours before rotation, and a confirmation email with your new key once rotated. Your old key remains valid for a 24-hour grace period after rotation.
Keep your API key secret. Anyone with your key has full access to your projects, keys, and source code. Never expose it in client-side code, public repositories, or Discord messages.

Using your API key

Include your API key as a Bearer token in the Authorization header of every request.
Always include a trailing slash at the end of your API endpoints (e.g., /projects/ instead of /projects) to ensure optimal performance and avoid redirect overhead.

Error responses

If your API key is missing or invalid, you’ll receive:
with HTTP status code 401 or 403.

Rate limits

Exceeding rate limits returns a 429 Too Many Requests response. Back off and retry after the window resets.