Create a token
- Sign in at app.liftpad.app and open Account, then API tokens.
- Give it a name you will recognize (for example GitHub Actions).
- Pick the team it may use (All my teams, or one team), the access (Deploy or Read only) and the expiry (90 days, 1 year or No expiry).
- Press Create token and copy it now: it starts with lp_ and is shown only once. Liftpad keeps only a hash of it.
Tokens are made only from a signed-in dashboard session: a token can never create another token.
Use it
curl -sS https://api.liftpad.app/v1/me -H "Authorization: Bearer $LIFTPAD_TOKEN"The CLI reads it from LIFTPAD_TOKEN or from ~/.liftpad.json. In CI, keep it in the platform's secret store, never in the repository.
Read or deploy
| Access | What it can do |
|---|---|
read | See sites, deploys, launch checks, domains, forms and submissions, analytics, teams, credits and the activity log. Never changes anything. Acts as a Team viewer. |
deploy | Everything read can, plus create sites, deploy, publish and roll back, take a site offline, connect and remove domains, code snippets, split tests and form submissions. Acts at most as a Developer, even when its owner is an Owner or Admin. |
A token is never stronger than the person who made it: if they are a Team viewer, the token only reads. A Billing member's token only reads.
Each operation in the API reference shows the lowest access that works, and its x-liftpad-scopes field in the OpenAPI document says the same.
What a token can never do
- Change your account, team members, invites, billing or plan.
- Read or change notifications (webhooks), or change a site's visitor password.
- Buy domains, buy credits or spend credits (the AI website builder).
- Delete a site or move it to another team.
- Act as a Liftpad operator, even when its owner is one.
These answer 403 with "error": "session_required", except deleting or moving a site, which answer 403 with "error": "forbidden" (a token acts at most as a Developer, and only an Owner may do them). Do them in the dashboard. Each operation's x-liftpad-token-error field in the OpenAPI document gives the exact code.
Expiry and revocation
- The expiry is chosen when the token is made (at most 730 days through the API). After it, calls answer 401.
- No expiry is allowed but not advised: for CI, prefer a deploy token limited to one team with a 90 day expiry, and replace it.
- Revoke one token in Account > API tokens. Changing your password or Sign out everywhere cancels all your tokens. Leaving or being removed from a team cancels your tokens limited to it.
- Last used shows when a token was last seen (updated at most once an hour).
Errors you may see
| HTTP | error | Meaning |
|---|---|---|
| 401 | unauthorized | No token, a wrong one, an expired or revoked one |
| 403 | session_required | This needs the dashboard (see above) |
| 403 | forbidden | Your role, or the token's access, is too low (also a token deleting or moving a site) |
| 404 | not_found | It does not exist, or this token cannot see it |
| 429 | rate_limited | Over 1200 requests a minute: wait and retry |