Lets GenAuthentication
Personal keys, scopes, and account access.
Read as Markdown ↗Bearer authentication
Send your personal key on every generation API request:
Authorization: Bearer lgk_…The lgk_ secret contains 64 lowercase hexadecimal characters. Session cookies are not a substitute for bearer authentication on the public API. Never send a key in a query string.
Scopes
| Scope | Access |
|---|---|
read | List models and voices; read owned public API tasks. |
generate | Submit media, text, or video analysis; upload reference media or voices. |
A generate-only key cannot poll tasks or list models. Use both scopes for a complete generation workflow. Use read-only access for discovery and monitoring.
Manage keys
Create and revoke keys through Settings → API keys in the signed-in Lets Gen app. You can name a key, set a future UTC expiration, and set a calendar-month Gem cap. There is a limit of 50 non-revoked keys. Secret values are shown only once; the platform stores hashes, not plaintext keys.
Key management endpoints use signed-in account authentication, not personal keys, and are separate from the generation API.
Revocation or expiration stops further access, including saved text-response replay. Revoking a key does not erase billing evidence or cancel existing provider work.
You can also manage these same personal keys on WeGen, using its standalone API keys page in the workspace or account menu.
Account policies
Your account's Gem balance, LLM allowance, paid-Gem consent, content preference, network/account blocks, and regional restrictions continue to apply. An API key does not bypass moderation or publish private content.
401 INVALID_API_KEY means the key is missing, malformed, revoked, or expired. 403 INSUFFICIENT_SCOPE means the key lacks the required scope. See Errors for other failures.