API Keys - Lofty Developer API

API keys (personal access tokens) are user-scoped credentials for authenticating with the Lofty API. They are well suited for personal automation, scripts, CLI usage, and server-side integrations where the developer controls the environment.

The Lofty CLI uses API keys as LOFTY_CUSTOMER_KEY for the Client Credentials flow. API keys are a fully supported authentication method — not just for testing.

Obtain your API key

Navigate to Settings → Integrations → API in your Lofty account to view or generate your key. Each key is bound to the account that generated it. Requests authenticated with that key operate within that account’s permissions and carry a THIRD_PARTY_OPERATION scope.

Key properties

Property	Description
Scope	`THIRD_PARTY_OPERATION` — enforced at token verification
Expiration	Configurable. Keys can have an `expires_at` date set at creation. Check your key’s expiry in account settings.
Revocation	Can be revoked immediately in account settings
Format	JWS token with metadata (not a static string)

Authenticate requests

Pass your API key in the Authorization header with the token prefix:

curl https://api.lofty.com/v1.0/leads \
  -H "Content-Type: application/json" \
  -H "Authorization: token <API_KEY>"

Or use the Lofty CLI:

export LOFTY_CUSTOMER_KEY="<API_KEY>"
lofty-cli leads list --limit 10

Security considerations

Do not expose keys in client-side code, public repositories, or logs.
Do not share keys with external vendors or third parties.
Keys are not subject to Lofty’s security review process — you are responsible for access control.
If a key is compromised, revoke it immediately in your account settings and generate a new one.
Monitor your key’s expiration date and rotate before it expires.

When to use each method

Scenario	Recommended
Personal automation or scripts	API Key
CLI usage (`lofty-cli`)	API Key (as `LOFTY_CUSTOMER_KEY`)
Server-to-server (no user interaction)	OAuth 2.0 Client Credentials + API Key
Third-party multi-tenant integrations	OAuth 2.0 Authorization Code
User-facing applications / SPAs	OAuth 2.0 with PKCE