Agency client access

Agency workspace

An agency key operates on the agency's own workspace when no client is supplied. This includes the agency's own programs, paid campaigns, creators, products, analytics, and supported organization operations.

REST client selection

To operate on a managed client instead, pass the client's Lucra organization slug:

curl "https://api.onlucra.com/v1/programs?client=acme" \
  -H "Authorization: Bearer $LUCRA_API_KEY"

Omitting client always keeps the request in the agency's own workspace. A client without a current active agency relationship returns 403 invalid_client.

MCP client selection

Pass the same slug as the tool's client argument:

{
  "name": "lucra.programs.list",
  "arguments": { "client": "acme", "limit": 20 }
}

Delegated-access behavior

Lucra revalidates the live agency-client link for reads and mutations. Review actions use the same delegated capability checks as the platform. Keys cannot broaden the agency's client access or bypass a client's approval-mode policy.