# Authentication

## Authentication Method

Authenticate every request with your API key as a bearer token. No other credentials are required.

```bash
curl https://api.lunchpayments.com/v1/organizations/vendor-88 \
  -H "Authorization: Bearer lux_sk_..."
```

Missing, malformed or revoked keys return `401` with `code: "unauthorized"`.

## API Keys

Keys begin with `lux_sk_`. Lunch issues and revokes keys. Self-service key management is not
available.

<Callout type="caution" title="Keep your API key secret">
Each key identifies your platform. Store it server-side. Never expose it in a browser, mobile app or
code repository.
</Callout>

## Live Requests

<Callout type="caution" title="There is no sandbox key">
All keys are live. The **Test** panel on reference pages sends real requests to
`https://api.lunchpayments.com`.
</Callout>

To test without moving money, ask Lunch to mark an organization as a test account before sending
requests for it.

These read-only endpoints are safe to call:

- `GET /v1/organizations/{externalId}`
- `GET /v1/webhooks`
- Either of the import reads

## Revoking and Rotating Keys

Contact Lunch to revoke a lost key. Revocation is immediate. Subsequent requests return `401`. When a
key is rotated, the new key is issued before the old one is revoked.

## What's Next

- [External IDs](/external-ids)