Authentication
Send the key on every request.
An API key on the Authorization header: Authorization: Bearer lm_live_....
A key is shown once and stored hashed. There is no credential in a path and none in a query string.
Web connectors register dynamically and run the OAuth 2.1 authorization code flow with PKCE. Command line clients run the device authorization grant. Both send the resulting access token on the same Authorization header.
Headers
| Header | Value | Notes |
|---|---|---|
Authorization | Bearer lm_live_YOUR_API_KEY | An API key with the prefix lm_live_, or an OAuth 2.1 access token. |
LeadMCP-Version | 2026-09-19 | The contract date the caller was written against. The response echoes the value. The current value is 2026-09-19. |
Docs for agents: llms.txt