Lunch
Guides

Authentication

Every request carries your key as a bearer token:

TerminalCode
curl https://api.luxor.lunchpayments.com/v1/organizations/vendor-88 \
  -H "Authorization: Bearer lux_sk_..."

Keys begin lux_sk_. A missing, malformed or revoked key answers 401 with code: "unauthorized" — the same shape as every other failure. There is nothing else to send: no account id, no signature, no clock.

Lunch issues and revokes keys for you; there is no self-service today. A key identifies your platform, not a person, so it belongs in your server's secret store and never in a browser, a mobile app, or a repository.

The playground on this site talks to production

There is no sandbox key

lux_sk_… is the only form a key takes, and it is a live one. A request you send from the Test panel on any reference page is a real request against https://api.luxor.lunchpayments.com: a business you create is created, an advance you take is taken.

If you want to exercise the API without moving money, ask us to mark a business as a test account before you point anything at it. Reads — GET /v1/organizations/{externalId}, GET /v1/webhooks, either of the import reads — change nothing and are the safe place to start.

Losing a key

Tell us and we revoke it; a revoked key stops working immediately and every request under it answers 401. Rotation is issue-then-revoke, so you are never without one.

Last modified on
OverviewFinancing an invoice