Every request carries a bearer credential: an API key for your own account, or an OAuth access token for an account that connected your app.
API keys
Owners and admins create keys in Settings → Developers → API. Give each key a name and its access, read or write. You can also set its webhook URL and the origins allowed to load embeds.
A key starts with lucra_live_ and is shown once. Keep it on your server, never in a browser or app.
curl https://api.onlucra.com/v1/account \
-H "Authorization: Bearer $LUCRA_API_KEY" \
-H "Lucra-Version: 2026-10-01"
Rotating or revoking a key takes effect immediately. Give each service or agent its own key, so you can revoke one without the others.
Which accounts a key reaches
A brand's key reaches only that brand.
A partner's key reaches:
- the partner's own account,
- every active client brand, including brands that become clients later,
- every creator on its roster.
To act for one of them, send its ID in the Lucra-Account header (acct_… or crtr_…), or use lucra.as(id) in the SDK. Leave the header out to act for the key's own account. An ID the key can't reach returns 403 account_not_reachable; GET /v1/brands lists the brands it can.
OAuth
Use OAuth when your app acts for Lucra accounts you don't own. People sign in to Lucra and approve your app, instead of handing you a key. The access token then works like a key with the access they granted. AI clients on the MCP server sign in this way too.