API Keys

Pro & EnterpriseAPI key management requires a Pro or Enterprise subscription.

Compare plans

API keys authenticate requests to the Layota embed and public API.

Key Types

Type	Use case
Read	Embed, SDK, public API — read-only access
Write	REST API — project management

All keys look the same on the wire — sk_ followed by 64 hex characters. The type is chosen when the key is created and shown next to the key prefix in the dashboard.

Neither key type can touch your account or organization: /api/auth/*, members, billing, webhooks, analytics dashboards and API-key management always require a signed-in user (JWT) and return 403 for a key. A leaked read key exposes published map data only.

Creating Keys

1. Go to Dashboard → API Keys
2. Click Create Key
3. Select the key type (Read or Write)
4. Copy the key — it's only shown once

Using Read Keys

Read keys are required when Allowed Domains are configured.

Web component:

<script src="https://app.layota.app/embed.js"></script>
<layota-map
  src="https://app.layota.app/embed/PROJECT_ID?apiKey=sk_..."
  style="width: 100%; height: 600px;"
></layota-map>

iframe:

<iframe src="https://app.layota.app/embed/PROJECT_ID?apiKey=sk_..."></iframe>

SDK:

const map = new LayotaMap({
  container: '#map',
  projectId: 'PROJECT_ID',
  apiKey: 'sk_...',
})

Using Write Keys

Write keys are used with the REST API for server-to-server access:

curl -H "Authorization: Bearer sk_..." \
     https://layota.app/api/projects/

DANGER

Never expose write keys in client-side code. Use them only on your backend server.

The embed enforces this: a write key placed in /embed/{id}?apiKey=... (or the SDK apiKey option) is refused by the public API with 403 and the code write_key_in_embed. Create a read key for embeds. Server-to-server calls to the public API keep working with either key type.

Revoking Keys

Delete a key from Dashboard → API Keys. Revocation is immediate — existing embeds using that key will stop working.