API clients

An API client is one set of credentials for one integration: a Looker Studio connector, a nightly warehouse job, an internal dashboard. It belongs to a single organization, reads only what you listed for it, and can be switched off without touching anything else.

Find the screen at Organization › API clients in the sidebar.

API clients screen listing three credentials with their access preset, secret expiry, last use and 30-day request count — The API clients list: one row per integration, five facts each.

What you need

The Manage API Clients permission (admin:manage_api_clients) in this organization. Without it the screen says "No access to API clients" — see Permissions.
The Business plan or above. On Free and Pro the screen shows a Public API · Business notice: clients issued earlier stay listed, but you can't create or rotate one, and the API itself refuses their tokens.

Creating a client

Press New client and fill in four things.

New API client dialog with name and description fields, scope presets, the scope checkboxes and the report and ad-account pickers — Creating a client — name it, pick what it may read, then pick what it may see.

1. Name and description

The name is what the list shows — "Looker Studio connector", "BigQuery nightly load". The description is optional and answers the question you'll have in six months: what reads this organization with these credentials?

2. What it may read — scopes

Scopes decide which endpoints answer. Two presets cover almost everything:

Preset	Scopes	Use it for
Reports only	`reports:read`, `reports:data`, `reports:export`	A BI tool or spreadsheet that pulls saved reports.
All read	Every scope below	A warehouse load that mirrors the whole organization.

The presets are a starting point, not a mode — the checkboxes stay editable afterwards. Individually:

Scope	Opens
`organizations:read`	The organization's own record.
`ad-accounts:read`	The connected ad accounts.
`campaigns:read`	The campaigns of those ad accounts.
`segments:read`	The organization's segments.
`reports:read`	The report list, report definitions and the metric catalogues.
`reports:data`	The numbers inside a report.
`reports:export`	The XLSX and CSV exports of a report.

3. What it may see — allow-lists

Scopes say which endpoints; allow-lists say which rows. Pick the reports and the ad accounts this client is allowed to read.

An empty allow-list means nothing, not everything

A client with reports:data but no reports listed reads no reports at all. This is deliberate: a credential should never widen its reach by accident.

At most 100 reports and 100 ad accounts may be listed. Past that the form asks you to use the wildcard switch instead, or to split the integration across two clients.
The pickers show only what you can see. The server applies the same cut when the client is issued, so a client can never read more than its creator could at the moment of creation.
The ad-account allow-list also governs campaigns: a campaign of an unlisted ad account is invisible to this client.

The two wildcard switches — All reports, including future ones and All ad accounts, including future ones — lift the list entirely, so anything the organization creates later is included without editing the client. They are owner-only: if you don't own the organization, the switches aren't there at all. Turning one on asks you to type ALL REPORTS or ALL AD ACCOUNTS to confirm; turning it back off needs no ceremony.

4. Secret lifetime

A secret has no expiry by default — the same contract a client secret has at Google, Meta or GitHub — and it works until you revoke it. If your security policy demands periodic rotation, pick a term of 30, 90, 180 or 365 days instead, and the list will warn you as the date approaches.

The secret is shown once

When the client is created, the secret appears in a modal. Copy it into your secret store right then:

Level cannot show it again

The secret is never stored in a readable form and never returned by any later read. If it's lost, the way forward is Rotate secret — not support.

The client_id looks like lvl-org-3f9a2c71 and is not a secret — it's shown on the row and copyable from the row menu at any time.

Reading the list

The list is five columns:

Column	What it says
Name	The name you gave it, with the client id underneath.
Access	The preset the scopes match — `Reports only`, `All read` — or `Custom · N`.
Expires	The soonest deadline among the client's live secrets, or `Never`. Inside 14 days it turns into a warning badge.
Last used	When a token of this client last called the API — `Today, 2:32 PM`, `Yesterday`, or a date. `Never` means it has never been used.
Requests · 30 d	How many calls it made in the last 30 days, with a red badge for the rejected ones.

On a phone the same five facts are a card. Either way, the row opens a details panel.

The details panel

Clicking a row opens everything that doesn't fit in the list:

API client details panel with the 30-day usage chart, the secret and its remaining term, the scopes and allow-lists, and the rotate and revoke buttons — The details panel — usage, secrets, scopes, and the two destructive actions.

A 30-day usage chart — accepted and rejected requests per day. A rejected count that won't go down usually means a missing scope or an exhausted quota; see Errors.
Every secret, each with how much of its term is left and its own revoke button.
Scopes and allow-lists as issued.
Rotate secret and Revoke client.

Rotating a secret

Rotate secret issues a second secret without switching off the first, so you can deploy the new one and only then retire the old:

Rotate

Press Rotate secret, choose the new secret's term, and copy the value.

Deploy

Put the new secret into the integration. Both secrets work while you do — a client may hold two active secrets at a time.

Revoke the old one

Back in the details panel, revoke the previous secret. No new token can be obtained with it from that moment.

A third rotation before you revoke one of the two is refused: two is the ceiling.

Revoking

Revoke a secret — that one credential stops issuing tokens. The client and its other secret stay. A token already issued from it keeps working until it expires — up to an hour.
Revoke the client — the whole client dies, all its secrets with it, and tokens already in flight are cut off within a second.

So if a secret has leaked, revoke the client, not just the secret: only that closes the window on a token somebody already holds.

Revocation is deliberately not plan-gated: an organization that drops off the Business plan can still see and switch off everything it handed out.

Limits


Clients per organization	10
Active secrets per client	2
Reports / ad accounts listed per client	100 each