This tutorial walks you through creating an API token in Lumail. API tokens allow your applications, integrations, and automations to securely access your organization's data.

## Why use API tokens?

- **Programmatic access** — Automate subscriber management, send emails, and sync data from your applications.
- **Secure authentication** — Tokens are scoped to your organization and can be revoked anytime.
- **Integration ready** — Connect Lumail with tools like Make.com, Zapier, n8n, or your custom backend.
- **No user credentials** — Keep your account secure by using tokens instead of username/password.

## Prerequisites

- A Lumail account with an organization.
- Owner or admin role in the organization.

## Step 1 — Navigate to API Keys

1. Log in to your [Lumail dashboard](https://lumail.io/orgs/default).
2. Click on **API Keys** in the sidebar.
3. Click the **Generate API Key** button.

![Generate token button](https://codelynx.mlvcdn.com/images/2026-01-05/clipboard_image_1767593749.png)

## Step 2 — Name your token

Give your token a descriptive name to identify its purpose:

- `Production API` — For your production application
- `Development` — For local development and testing
- `Zapier Integration` — For Zapier automation
- `Webhook Handler` — For processing workflow webhooks

![Name your token dialog](https://codelynx.mlvcdn.com/images/2026-01-05/clipboard_image_1767593767.png)

Click **Create** to generate your token.

## Step 3 — Copy and save your token

Your token will be displayed only once. Copy it immediately and store it securely.

![Token created dialog](https://codelynx.mlvcdn.com/images/2026-01-05/clipboard_image_1767593788.png)

The token format is `lum_` followed by a 64-character string:

```
lum_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6
```

Store it in your environment variables:

```bash
# .env.local (never commit this file)
LUMAIL_API_TOKEN=lum_your_token_here
```

## Step 4 — Use your token

Include the token in the `Authorization` header of your API requests:

```javascript
const response = await fetch("https://lumail.io/api/v1/subscribers", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.LUMAIL_API_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    email: "user@example.com",
    name: "Jane Doe",
    tags: ["newsletter"],
  }),
});

const data = await response.json();
console.log(data);
```

## Security best practices

1. **Never commit tokens to version control** — Use environment variables or secret managers.
2. **Use separate tokens** — Create different tokens for development, staging, and production.
3. **Rotate tokens regularly** — Generate new tokens periodically and delete old ones.
4. **Delete unused tokens** — Remove tokens you no longer need from the settings page.

## Managing tokens

To view, or delete existing tokens:

1. Go to [API Keys](https://lumail.io/orgs/default/api-keys).
2. View all active tokens with their creation dates.
3. Click the delete icon to revoke a token.

Deleting a token immediately revokes access — any applications using it will fail authentication.

## Related Documentation

- [API Tokens Reference](/docs/api-reference/api-tokens) - Complete token documentation
- [Create Subscriber API](/docs/api-reference/api-subscribers-post) - Add subscribers
- [Send Email API](/docs/api-reference/api-emails-send) - Send transactional emails
- [Update Subscriber API](/docs/api-reference/api-subscribers-patch) - Update subscriber data
- [Tags API](/docs/api-reference/api-tags-get) - Manage tags
- [Track Events API](/docs/api-reference/api-events-post) - Track subscriber activity
- [V0 Capture Page Tutorial](/docs/tutorials/v0-capture-page) - Use tokens in capture pages
- [Dynamic Promo Codes](/docs/tutorials/dynamic-promo-codes) - Use tokens in webhooks
- [Webhook Step](/docs/workflows/workflow-webhook-step) - Authenticate webhook callbacks