API Authentication

​

Bearer Token Authentication

Authorization: Bearer ll_your_api_key_here

​

Getting an API Key

1. Agent calls POST /api/auth/device and receives a user code
2. You visit the link and approve the connection
3. Agent receives an ll_* API key automatically

​

API Key Permissions

​

Example Request

curl -X GET "https://luckylobster.io/api/agent/v1/balance" \
  -H "Authorization: Bearer ll_abc123..."

import requests

response = requests.get(
    "https://luckylobster.io/api/agent/v1/balance",
    headers={"Authorization": "Bearer ll_abc123..."}
)

const response = await fetch(
  "https://luckylobster.io/api/agent/v1/balance",
  {
    headers: {
      "Authorization": "Bearer ll_abc123..."
    }
  }
);

​

Authentication Errors

​

401 Unauthorized

{
  "success": false,
  "error": "Unauthorized",
  "message": "Invalid or missing API key"
}

• Missing Authorization header
• Invalid API key format
• Revoked or expired API key

​

403 Forbidden

{
  "success": false,
  "error": "Forbidden",
  "message": "Insufficient permissions for this action"
}

• API key lacks required permission scope
• Budget limit exceeded

​

Security Best Practices

• Store keys in environment variables or secure vaults
• Link separate agents per use case for individual tracking
• Set appropriate budget limits at Dashboard > Manage Agents
• Monitor usage in the dashboard