Skip to main content
LocalAds API keys belong to one organization. The key determines which organization’s brands and resources a request can access, so requests never accept an organization ID. Brand-owned collection requests use brand_id.

​
Send the key

Include the key in the Authorization header using the bearer scheme:

​
Keep keys safe

  • Store keys in a secrets manager or server environment variable.
  • Never put a key in browser code, mobile binaries, logs, or source control.
  • Never send a key in a URL or query parameter.
  • Revoke and replace a key immediately if it is exposed.
The full secret is displayed only when the key is created. LocalAds stores a hash and cannot show the secret again.

​
Plan requirement

API access is available on the Pro and Enterprise plans. A key belonging to an organization on another plan, or in a trial, receives 403 Forbidden with the code plan_upgrade_required. A key belonging to a suspended organization receives 403 with the code org_suspended. Keys are not deleted when a plan changes: upgrading again restores them.

​
Create a key

Workspace owners and admins on the Pro or Enterprise plan create keys in LocalAds under Settings > API keys. Give every integration or agent its own key so you can revoke it on its own. What a key can do, and its other limits:

API keys and permissions

Access levels, the permission table, expiry, and monthly credit budgets.

Rate limits

Per-minute budgets per key, and Retry-After.

Credits and spending

What each operation costs, and how to cap what a request spends.
Last modified on September 30, 2026