Skip to main content

​
Bearer token

All API requests require a Bearer token in the Authorization header.

​
Getting your API key

API keys are provisioned when your account is set up. Each key is prefixed with lumisreach_ and should be kept secret.
API keys are hashed before storage. If you lose your key, you will need to generate a new one.

​
Key format

​
Key scopes

Every API key is tied to one of three scopes, which controls what resources the key can see: Tenant isolation is enforced server-side on every endpoint. A sub-entity-scoped key cannot read or write across to a sibling sub-entity or up to the umbrella’s private resources. To pick the right scope:
  • One key for everything? → organization-scoped.
  • Vendor needs to manage one location? → sub-entity-scoped. Revoke the key without affecting the rest of the org.
  • Solo developer / single-user account? → user-scoped.
See Sub-entities for how to provision sub-entities and issue per-sub-entity keys.

​
Security best practices

  • Store API keys in environment variables, never in source code
  • Rotate keys periodically — revoke the old key in Settings → API Keys, then issue a new one (plaintext is shown once at creation; we only store the SHA256 hash)
  • Use separate keys for development and production
  • Use the smallest scope that works — prefer sub-entity-scoped keys for per-location vendor integrations
  • Monitor key usage via the account endpoint