Overview

All API requests require authentication via the Authorization header.

Method	Header format	Best for
OAuth 2.0	`Bearer <access_token>`	Multi-tenant apps, third-party integrations
API Key	`token <api_key>`	Personal automation, scripts, CLI

Which method should I use?

Scenario	Method	Grant Type
CLI tool (`lofty-cli`)	API Key	Used as `LOFTY_CUSTOMER_KEY` in Client Credentials
Personal scripts / automation	API Key	Direct `token` header
Server-to-server (no user)	OAuth 2.0	Client Credentials + `customer_key`
Web app (user authorizes)	OAuth 2.0	Authorization Code
SPA / mobile app	OAuth 2.0	Authorization Code + PKCE
Multi-tenant SaaS platform	OAuth 2.0	Authorization Code

Three grant types: Authorization Code, PKCE, and Client Credentials. Scoped permissions with security review.

User-scoped personal access tokens. Configurable expiration and THIRD_PARTY_OPERATION scope.

https://api.lofty.com

curl https://api.lofty.com/v1.0/leads \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <access_token>"

Or via CLI:

lofty-cli leads list --limit 10

HTTP Status	Code	Description
`401`	—	Invalid or missing authentication credentials.
`403`	`200100`	Token is valid but lacks the required permission scope. Grant the scope in the Developer Portal and re-authorize.
`429`	—	Rate limit exceeded. Retry with backoff.

See Error Codes for the full reference.