Authentication

Every request is authenticated with a bearer API key, scoped to your own account — a key can only ever create payment links that pay you.

1. Generate a key

Log into Loofta and open API key & branding. Click "Generate API key" — the raw key is shown once. Store it somewhere safe; Loofta only ever stores a salted hash of it.

Keys are live (mainnet) — payments made through them move real money. There is no sandbox mode yet; test with small real amounts.

2. Send it as a bearer token

Authorization: Bearer lft_live_...

Generating vs. rotating

These are opposites, so pick deliberately:

• Generate — revokes your existing key and mints a fresh one in its place. Use this if a key may have leaked, or you just want a clean slate.
• Rotate — mints an additional key without touching the old one, so you can switch your deployed code over on your own schedule before manually revoking the old key. Use this for a zero-downtime swap.

Revoked keys stop working immediately. The raw key value is only ever shown once, at creation — Loofta stores just a salted hash of it.