An API key is a string you send as the X-API-KEY header on every request. It identifies the organisation, not the person and not the LinkedIn account — one key reaches every LinkedIn account that organisation has connected, and no others.
What it is not
- Not per LinkedIn account. The account is named in the request, not in the key.
- Not per plan. The same key works on /v1 and on /premium; the base path chooses the plan.
- Not recoverable. You see the full key once, when you mint it. After that we hold only enough to check it.
The mistake worth avoiding
A key in a URL ends up in logs — yours, ours, and every proxy in between. The one place this API puts a key in a URL is the MCP address, and that address is meant to be pasted into an assistant's configuration rather than fetched, linked or shared. If you paste it anywhere a human can see it, mint a new key and revoke that one.
Rotating one
Mint the new key first, deploy it, then revoke the old one. Doing it the other way round gives you a window where nothing works, and the window is exactly as long as your slowest deploy.
Two keys working at once is fine and is the point: nothing ties a key to a session, so there is no state to migrate. Revoking takes effect on the next request rather than at the end of anything.