Skip to main content
Every /v1 endpoint except GET /v1/health requires an API key.

​
Create a key

  1. Open the Lusor app and go to Settings → API Keys.
  2. Create a key and give it a name you will recognise later.
  3. Copy the key. It starts with lusor_ and is shown once. Lusor does not store it in a form it can show again.
Workspace admins and members can create and revoke keys, signed in to the Lusor app. Viewers can see the list of keys but cannot create or revoke them. An API key cannot create or revoke keys.

​
Send the key

Use either header. They are equivalent:

​
A key belongs to one workspace

Each key is bound to the workspace it was created in:
  • Endpoints that take an optional workspaceId (query or body) use the key’s workspace when you leave it out.
  • Endpoints with {workspaceId} in the path need your workspace id. Read it from the workspaceId field of any agent (GET /v1/agents).
  • A request that names any other workspace returns 404, the same response as a resource that does not exist.

​
Keep keys secret

  • Call the API from your server, never from a browser or a mobile app you ship. Anyone holding the key can act on your workspace’s phones.
  • Store keys in a secret manager or environment variables, not in source control.
  • Revoke a key in Settings → API Keys as soon as it is no longer needed or may have leaked.

​
Errors

See Errors for every other error code.