Every API key and OAuth grant has one of two access levels. Each endpoint in the reference is marked with the level it needs.
| Access | Allows |
|---|---|
read | Every read |
write | Reads and writes |
Start a new integration or an AI agent on read, and move to write once you trust it with every write, including ones that move money.
OAuth tokens
An OAuth grant is read or write too, and a token never does more than the person who granted it. Owners and admins can do everything; other members read everything but payments, and can't make changes.
Acting as a creator
A partner acts for a roster creator with Lucra-Account: crtr_…. That needs a write key, even for reads, and works only on endpoints marked for creators. See Partners.
What stays in the app
Managing your team, API keys and OAuth apps happens in the Lucra app.
Card and bank details, identity checks and platform sign-ins happen on hosted pages, so they never pass through your server. POST /v1/connections returns the page to send the person to, and a webhook tells you when they're done.