Sign in
API reference

Authentication & API keys

Create a key in Lucra

Workspace Owners and Admins can open Settings → API and MCP to create, rotate, and revoke API keys. The secret is shown once. Lucra stores only its SHA-256 digest, prefix, and final four characters.

At creation time, choose:

  • a descriptive key name;
  • exact business scopes;
  • a 30-day, 90-day, 365-day, or No expiry lifetime.

No-expiry keys remain active until revoked or rotated, so use them only where rotation is operationally difficult and review them regularly.

Send the key

Use the key as a bearer credential:

curl "https://api.onlucra.com/v1/programs" \
  -H "Authorization: Bearer $LUCRA_API_KEY"

Managed keys begin with lucra_live_. Do not put them in browser code, URLs, logs, source control, or support messages.

Brand and agency actors

Keys are issued for the organization that creates them:

  • brand keys are permanently bound to that brand workspace;
  • partner keys belong to an agency. They use the agency's own workspace by default and can explicitly target any organization with a currently active agency-client relationship.

Creator self-service is not part of the public API.

Rotation and revocation

Rotation invalidates the old secret immediately and shows a replacement once. Revocation also takes effect immediately. Agency-client access is rechecked on every authentication, so a removed or inactive client relationship stops working immediately.