API authentication
Organisation keys, headers and your first request.
API origin
Use the public panel origin: https://lumin.edu.pl/v1. Examples assume an organisation key stored in your backend environment as LUMIN_API_KEY.
curl --fail-with-body https://lumin.edu.pl/v1/orgs \
-H "Authorization: Bearer $LUMIN_API_KEY"
Create a key
Open API keys within an organisation, name your integration and copy its secret. The full key is shown only when created. If lost, create a replacement and revoke the old key.
Send Authorization: Bearer sak_.... Add Content-Type: application/json for JSON request bodies.
Permissions
A key acts as an admin of exactly one organisation. It is neither a user account nor a platform administrator. Never send it to a player or hosting customer's browser.
| Operation | Organisation key |
|---|---|
| Read and configure own routes | Yes |
| Read monitoring and plan usage | Yes |
| Read other organisations | No |
| Create an organisation | No |
| Change roles requiring owner access | No |
| Administer the platform | No |
User sessions
User login provides a short-lived access token and rotating refresh token. This differs from an integration key. Use an API key for server-side hosting processes; do not automate logging in with an administrator's password.