Authentication

Use scoped API keys safely across development and production.

Choose the right key

Lumen authenticates every request with a Bearer token. Use sandbox keys for development and live keys for production. Keys belong to a workspace and can be restricted to read-only access.

curl https://api.lumen.dev/v1/providers -H "Authorization: Bearer $LUMEN_API_KEY"

curl https://api.lumen.dev/v1/providers -H "Authorization: Bearer $LUMEN_API_KEY"

curl https://api.lumen.dev/v1/providers -H "Authorization: Bearer $LUMEN_API_KEY"

Rotate without downtime

Create a replacement key, deploy it to your services, then revoke the old key. Never log authorization headers. A missing or revoked key returns HTTP 401; insufficient scope returns HTTP 403.