Authentication - LuminPay Docs

LuminPay uses API keys to authenticate requests. You can generate and manage your keys from your dashboard.

Making authenticated requests

Include your API key in the Authorization header of every request, as a Bearer token. Use your Sandbox key against the Sandbox base URL while testing (see Sandbox vs Live):

curl https://sandbox-api.luminpay.co/charges \
  -H "Authorization: Bearer YOUR_TEST_API_KEY"

Once you go live, switch to your Live key and the Live base URL:

curl https://api.luminpay.co/charges \
  -H "Authorization: Bearer YOUR_LIVE_API_KEY"

Keep your API key secret. Never expose it in client-side code, public repositories, or anywhere a third party could access it. If a key is compromised, revoke it immediately from your dashboard and generate a new one.

Revoking a key

If you need to rotate or retire a key, revoke it from the API Keys section of your dashboard, or programmatically:

curl -X PATCH https://api.luminpay.co/api-keys/{id}/revoke \
  -H "Authorization: Bearer YOUR_API_KEY"

Revoked keys stop working immediately.

​Making authenticated requests

​Revoking a key

Making authenticated requests

Revoking a key