Lanes for developers and agents

This page is the single entry point for building against Lanes, whether you are a person or an agent. Every resource below lives at a stable URL.

Machine-readable index

Every documentation, use-case, and comparison page is also available as clean Markdown. Add .md to the path, or send Accept: text/markdown to any page URL.

The REST API

Base URL https://api.lanes.sh. The public product surface is Lanes Forms.

# Provision a live form endpoint with no account at all
curl -X POST https://api.lanes.sh/v1/forms \
  -H 'Content-Type: application/json' \
  -d '{"name":"Contact","schema":[{"name":"email","type":"email","required":true}]}'

• POST /v1/forms provision a form, anonymously or with a workspace key
• POST /v1/f/{form_id} submit to a form
• GET /v1/forms/{form_id} form config and counters
• PATCH /v1/forms/{form_id} update name, origins, schema, or workflow
• GET /v1/forms/{form_id}/submissions paginated submissions and CSV export
• POST /v1/workspaces/{workspace_id}/api-keys create a workspace API key

Full reference: API reference.

Authentication

Two credentials, both presented as Authorization: Bearer <token>:

• Workspace API key (lfk_...). Created in the dashboard, self-serve, no sales call. Scoped to one workspace. Use it server-side only, never in a browser. See API keys.
• Firebase ID token. The dashboard session credential, used by the browser app.

Machine-readable declaration of the auth model, including the supported scope vocabulary and bearer presentation method, is published as RFC 9728 protected-resource metadata at https://api.lanes.sh/.well-known/oauth-protected-resource.

Lanes Link, the self-hosted MCP endpoint, implements full OAuth 2.0 separately, including RFC 8414 authorization-server metadata, dynamic client registration, and PKCE.

Working with no credential

Form provisioning and submissions to an open form need no credential at all. That is the zero-auth path an agent can take mid-task, and it is deliberate: POST /v1/forms returns a live endpoint plus a claim link to hand to the site owner. A free plan and self-serve key generation cover everything beyond that. There is no contact form between you and a working integration.

MCP servers

Three, for three different jobs. Full comparison at lanes.sh/docs/mcp.

Lanes MCP (hosted, Streamable HTTP). Provision and manage form endpoints. No signup.

claude mcp add --transport http lanes https://api.lanes.sh/mcp

Optional Authorization: Bearer lfk_... upgrades an anonymous session to your workspace. The server exposes tools, resources, and prompts.

Lanes Desktop MCP (local, SSE). Read the issue board and drive coding sessions.

claude mcp add --transport sse lanes-desktop http://localhost:5353/sse

Lanes Link (self-hosted, Streamable HTTP). One endpoint holding your connected accounts, memory, skills, and secrets behind a single permission boundary and audit log. Documented at lanes.sh/docs/link; open source at github.com/lanes-sh/link.

CLI

Lanes Desktop is published on Homebrew. The lanes CLI is published on npm as @lanes-sh/link and runs on Bun. Installing the app installs the CLI, and updating the app updates it, so the second line here is only for a CLI you want without the app.

# Lanes Desktop, the macOS app. This brings the `lanes` CLI with it
brew install --cask lanes-sh/lanes/lanes

# Or the `lanes` CLI on its own
bun install -g @lanes-sh/link
lanes link profile add personal --default
lanes link connect gmail
lanes link start
lanes link mcp add

Installing the CLI needs Bun 1.3.11+, on macOS or Linux. It is distributed through the npm registry but installed with Bun deliberately: bin/lanes execs bun run over the shipped TypeScript source, so npm install -g would install cleanly and then fail at first run.

There is also a lanes-forms skill and a lanes-desktop plugin for Claude Code:

/plugin marketplace add lanes-sh/app
/plugin install lanes-forms@lanes

Errors

Domain endpoints return a stable envelope:

{ "error": { "code": "submission_rate_limited", "message": "...", "docs_url": "..." } }

code is the stable identifier to branch on; the HTTP status carries the class. The complete vocabulary, with the fix for each code, is at lanes.sh/docs/forms/errors.

Every response carries x-request-id. Quote it when reporting a problem.

Rate limits

Responses carry the RateLimit-Policy and RateLimit header fields from the IETF draft-ietf-httpapi-ratelimit-headers specification, plus the older RateLimit-Limit / RateLimit-Remaining / RateLimit-Reset trio for clients that only understand those. A 429 carries Retry-After in seconds. Read them rather than guessing a backoff. The documented limits and the exact header syntax are at lanes.sh/docs/forms/rate-limits.

Versioning and deprecation policy

The API is versioned in the URL path. /v1 is current, and a breaking change ships as a new path segment rather than as a change to an existing one.

Within a version, we treat these as backwards compatible and may ship them at any time: new endpoints, new optional request fields, new response fields, new error code values, and new enum members on fields documented as extensible. Write clients that ignore unknown response fields.

When an endpoint or a version is retired:

1. It is marked deprecated in the OpenAPI document (deprecated: true) and in these docs.
2. Its responses carry the Deprecation header (RFC 9745) giving the date the deprecation took effect, and a Sunset header (RFC 8594) giving the date it stops working.
3. Responses also carry a Link header with rel="deprecation" pointing at this page.
4. There is at least six months between the Sunset header first appearing and the endpoint being switched off.

An endpoint with no Sunset header is not scheduled for removal. Agents should surface a Sunset date rather than ignoring it.

Where to go next

• Documentation
• Agents and MCP
• Security and trust
• Pricing
• Questions: [email protected] or Discord