# Authentication

> API keys, OAuth tokens and the accounts they reach.

Source: https://www.onlucra.com/docs/authentication

Every request carries a bearer credential: an API key for your own account, or an OAuth access token for an account that connected your app.

## API keys

Owners and admins create keys in **Settings → Developers → API**. Give each key a name and its [access](https://www.onlucra.com/docs/access), `read` or `write`. You can also set its webhook URL and the origins allowed to load [embeds](https://www.onlucra.com/docs/embeds).

A key starts with `lucra_live_` and is shown once. Keep it on your server, never in a browser or app.

```bash
curl https://api.onlucra.com/v1/account \
  -H "Authorization: Bearer $LUCRA_API_KEY" \
  -H "Lucra-Version: 2026-10-01"
```

Rotating or revoking a key takes effect immediately. Give each service or agent its own key, so you can revoke one without the others.

## Which accounts a key reaches

A brand's key reaches only that brand.

A [partner's](https://www.onlucra.com/docs/api-partners) key reaches:

- the partner's own account,
- every active client brand, including brands that become clients later,
- every creator on its roster.

To act for one of them, send its ID in the `Lucra-Account` header (`acct_…` or `crtr_…`), or use `lucra.as(id)` in the [SDK](https://www.onlucra.com/docs/sdk#act-for-an-account). Leave the header out to act for the key's own account. An ID the key can't reach returns `403 account_not_reachable`; `GET /v1/brands` lists the brands it can.

## OAuth

Use [OAuth](https://www.onlucra.com/docs/oauth) when your app acts for Lucra accounts you don't own. People sign in to Lucra and approve your app, instead of handing you a key. The access token then works like a key with the access they granted. AI clients on the [MCP server](https://www.onlucra.com/docs/mcp) sign in this way too.