Create a key

Back office → Point of sale → Developer API → New API key → Create key (needs the "Change business settings" permission).

Field	What it means
Name	What uses the key, e.g. "Website" or "Power BI".
What it can do (scopes)	Tick only what that system needs (table below).
Default store	Prices and stock come from this store unless a request passes `location_id`.
Requests per minute	10 to 1,200; 120 by default.

Keys don't expire on their own — they work until you Revoke them.

The key is shown once — copy it, then press I've saved it. LeisureNexus stores only a fingerprint of it, so nobody — not even support — can show it again. The list shows its first 12 characters (e.g. lnk_8Hq2xK9a), when it was last used, and its scopes.

Scopes

Scope	Allows
`catalog.read`	Read items, prices, departments and stores
`stock.read`	Read stock on hand
`customers.read`	Read customers
`customers.write`	Add and update customers
`orders.read`	Read sales and refunds
`orders.write`	Place wholesale orders

A call without the right scope gets 403 with code missing_scope and the scope it needs.

Sending the key

Use either header:

Authorization: Bearer lnk_your_key_here

X-Api-Key: lnk_your_key_here

Rotate a key

Create a new key with the same scopes.
Deploy it to your system.
When the old key's "last used" stops moving, revoke it.

Revoke a key

Developer API → the key → Revoke. It stops working on the next request.

Keep keys safe

One key per system, so you can revoke one without breaking the others.
Store keys in your server's secret store or environment variables — never in source code, a web page or an app.
Give each key the fewest scopes and the right default store.
If a key may have leaked, revoke it immediately and create a new one.