Skip to main content
A Lanesurf API key looks like ls_live_…. Send it as a bearer token on every request except signup and /health:

​
Get a key

The key is shown once, in the verify answer. Lanesurf stores only a hash of it and can’t show it again.

​
What a key is

  • One key = one rep at a brokerage (role: broker) or one carrier signup (role: carrier).
  • Keys don’t expire. A key works until it is revoked.
  • GET /v1/me says who a key belongs to: key_id, key_prefix (the first characters, safe to show), role, and for carriers verification.
  • A missing key answers 401 missing_api_key; a wrong or revoked one answers 401 invalid_api_key.

​
OAuth tokens (AI apps)

When an app signs in on the Lanesurf page, it gets OAuth tokens instead of a raw key. Each sign-in stands for one Agent API key.

​
Replace (rotate) a key

To replace a key with a new one:
  1. Get a new key. A carrier signs up again with the same MC/DOT number and work email (signup limits apply: 5 per email per hour). A broker asks their Lanesurf admin or account manager.
  2. Switch your agent to the new key and check it with GET /v1/me.
  3. Revoke the old key: email support@lanesurf.com with the old key’s key_prefix (never the whole key).

​
Revoke a key

If a key leaked, or a person left, email support@lanesurf.com with the key_prefix and say why. Lanesurf revokes it; from then on it answers 401 invalid_api_key, and every app signed in with it is signed out.

​
Keep keys secret

  • Never paste a key into a chat, a ticket, a log or a URL. Show key_prefix instead.
  • Store it as a secret (an environment variable such as LANESURF_API_KEY, or the connector’s header field).
  • An agent hands a new key to the person once, to store, and never repeats it.
  • Use one key per person or per agent, so revoking one doesn’t stop the others.