Authentication
The admin REST API uses `admin`-type keys. Each key belongs to one tenant and can only act on its data. The MCP server also supports OAuth 2.1.
Key format
Keys are prefixed with luk_ followed by a random identifier. Send them in the Authorization header using the Bearer scheme:
shell
Authorization: Bearer luk_a1b2c3d4e5f6...Scopes
Every key carries a list of scopes that determines which resources it can read or write. Scopes follow the resource:action pattern:
| Resource | Read | Write |
|---|---|---|
| Customers | customers:read | customers:write |
| Orders & bookings | orders:read | orders:write |
| Products & catalogue | products:read | products:write |
| Instructors | instructors:read | instructors:write |
| Inventory | inventory:read | inventory:write |
| Finance | finance:read | finance:write |
| Marketing (email campaigns) | marketing:read | marketing:write |
A request to an endpoint that requires a scope the key doesn't have returns 403 Forbidden.
Rotation and revocation
You can rotate a key's secret at any time from the panel — the previous secret stops working immediately. Revoking a key disables it permanently; requests using it will get 401 Unauthorized.
Best practices
- Use one key per integration: makes rotation painless.
- Always request the minimum scopes you need.
- Store keys in a secrets manager, not in your repository.
- For browser integrations, configure allowed origins; CORS does not protect a key exposed to the client.