Authentication
The public API authenticates exclusively with API Keys. Each key belongs to a single tenant and can only act on that tenant's data.
Key format
Keys are prefixed with luk_ followed by a random identifier. Send them in the Authorization header using the Bearer scheme:
shell
Authorization: Bearer luk_a1b2c3d4e5f6...Scopes
Every key carries a list of scopes that determines which resources it can read or write. Scopes follow the resource:action pattern:
| Resource | Read | Write |
|---|---|---|
| Customers | customers:read | customers:write |
| Orders & bookings | orders:read | orders:write |
| Products & catalogue | products:read | products:write |
| Instructors | instructors:read | instructors:write |
| Inventory | inventory:read | inventory:write |
| Payments & invoices | payments:read | payments:write |
A request to an endpoint that requires a scope the key doesn't have returns 403 Forbidden.
Rotation and revocation
You can rotate a key's secret at any time from the panel — the previous secret stops working immediately. Revoking a key disables it permanently; requests using it will get 401 Unauthorized.
Best practices
- Use one key per integration: makes rotation painless.
- Always request the minimum scopes you need.
- Store keys in a secrets manager, not in your repository.
- Restrict by IP when your integration runs from a known server.