# Authentication

Every request carries your key as a bearer token:

```bash
curl https://api.luxor.lunchpayments.com/v1/organizations/vendor-88 \
  -H "Authorization: Bearer lux_sk_..."
```

Keys begin `lux_sk_`. If one is missing, malformed or revoked you get a `401` with
`code: "unauthorized"`, in the same shape as every other failure. There is nothing else to send:
no account id, no request signature, no timestamp.

Lunch issues and revokes keys for you, so there is no self-service today. A key identifies your
platform rather than a person, which means it belongs in your server's secret store and should
never reach a browser, a mobile app or a repository.

## The playground on this site talks to production

<Callout type="caution" title="There is no sandbox key">
`lux_sk_…` is the only form a key takes, and it is a live one. Anything you send from the **Test**
panel on a reference page is a real request against `https://api.luxor.lunchpayments.com`. A
business you create is created, and an advance you take is taken.
</Callout>

If you want to exercise the API without moving money, ask us to mark a business as a test account
before you point anything at it. The reads are the safe place to start, since none of them change
anything: `GET /v1/organizations/{externalId}`, `GET /v1/webhooks`, and either of the import reads.

## Losing a key

Tell us and we will revoke it. A revoked key stops working immediately and every request under it
answers `401`. We rotate by issuing the new key before revoking the old one, so you are never left
without a working key.