Create an API Token

This tutorial walks you through creating an API token in Lumail. API tokens allow your applications, integrations, and automations to securely access your organization's data.

Why use API tokens?

• Programmatic access — Automate subscriber management, send emails, and sync data from your applications.
• Secure authentication — Tokens are scoped to your organization and can be revoked anytime.
• Integration ready — Connect Lumail with tools like Make.com, Zapier, n8n, or your custom backend.
• No user credentials — Keep your account secure by using tokens instead of username/password.

Prerequisites

• A Lumail account with an organization.
• Owner or admin role in the organization.

Step 1 — Navigate to API Tokens

1. Log in to your Lumail dashboard.
2. Click on Settings in the sidebar.
3. Select API Tokens from the settings menu.
4. Click the Generate Token button.

Step 2 — Name your token

Give your token a descriptive name to identify its purpose:

• Production API — For your production application
• Development — For local development and testing
• Zapier Integration — For Zapier automation
• Webhook Handler — For processing workflow webhooks

Click Create to generate your token.

Step 3 — Copy and save your token

Your token will be displayed only once. Copy it immediately and store it securely.

The token format is lum_ followed by a 64-character string:

lum_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6

Store it in your environment variables:

# .env.local (never commit this file)
LUMAIL_API_TOKEN=lum_your_token_here

Step 4 — Use your token

Include the token in the Authorization header of your API requests:

const response = await fetch("https://lumail.io/api/v1/subscribers", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.LUMAIL_API_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    email: "user@example.com",
    name: "Jane Doe",
    tags: ["newsletter"],
  }),
});

const data = await response.json();
console.log(data);

Security best practices

1. Never commit tokens to version control — Use environment variables or secret managers.
2. Use separate tokens — Create different tokens for development, staging, and production.
3. Rotate tokens regularly — Generate new tokens periodically and delete old ones.
4. Delete unused tokens — Remove tokens you no longer need from the settings page.

Managing tokens

To view, or delete existing tokens:

1. Go to Settings → API Tokens.
2. View all active tokens with their creation dates.
3. Click the delete icon to revoke a token.

Deleting a token immediately revokes access — any applications using it will fail authentication.

Related Documentation

• API Tokens Reference - Complete token documentation
• Create Subscriber API - Add subscribers
• Send Email API - Send transactional emails
• Update Subscriber API - Update subscriber data
• Tags API - Manage tags
• Track Events API - Track subscriber activity
• V0 Capture Page Tutorial - Use tokens in capture pages
• Dynamic Promo Codes - Use tokens in webhooks
• Webhook Step - Authenticate webhook callbacks