Keys
- A key belongs to a team, not a person or a workspace. One key can reach every workspace.
- Live keys start with
lt_live_. Test keys start withlt_test_and never post to a platform. - A key is shown once and stored as a SHA-256 hash. If you lose it, revoke it and create another.
- Scopes are fixed when the key is created. Give each job its own key with only the scopes it needs.
Headers
Send the key as a Bearer token or in X-API-Key. Both work the same. Never put a key in a URL. GET /me needs no scope and returns the scopes the key carries.
Either header
curl "https://looptake.com/api/v1/me" -H "Authorization: Bearer $LOOPTAKE_API_KEY"
curl "https://looptake.com/api/v1/me" -H "X-API-Key: $LOOPTAKE_API_KEY"Scopes
Every endpoint needs exactly one scope. Read and write are separate.
| Scope | Grants |
|---|---|
generations:read | List suggestions, read one in full, and read the trend library. |
generations:write | Generate suggestions, accept one into content, and create A/B hook variants. |
posts:read | List posts, read one with its per-platform results, and read the calendar. |
posts:write | Create posts, schedule them, and cancel one that has not published yet. |
posts:approveSession only | Approve or reject a post that is waiting for review. Deliberately not implied by posts:write, and held only by a signed-in reviewer: an API key cannot be minted with it, because an approval has to name the person who made it. |
automations:read | List automations, read one, and list the posts an automation produced. |
automations:write | Create, edit, generate, extend, launch, pause, resume and cancel automations. |
influencers:read | List AI influencers, read one, and read their rendered videos. |
influencers:write | Create AI influencers and render talking-head videos for them. Both spend credits. |
assets:read | List the workspace asset library: clips, images, audio and fonts. |
assets:write | Add an asset to the library by URL. |
content:write | Start a content studio render, read its status, and download the finished media. |
accounts:read | List connected TikTok, Instagram and YouTube accounts and their connection status. |
credits:read | Read the credit balance and the ledger, including refunds. |
workspaces:read | List workspaces and read one with its brand context. |
workspaces:write | Create a workspace and re-derive its brand context from a URL. |
analytics:read | Read the performance overview and per-post analytics. |
webhooks:write | List, create, edit and delete webhook endpoints. There is no separate read scope. |
posts:approve is session only: an approval must name a person, so no key can hold it. Use client review links for approvals.
Failures
unauthorized(401): No key, an unreadable key, or a key that is no longer valid. Every auth failure returns this same type and message.forbidden_scope(403): The key is valid but does not carry the scope this endpoint requires. The message names the missing scope.- A resource in another team is
404 not_found, never 403.
403
{
"success": false,
"error": { "type": "forbidden_scope", "message": "This key does not carry posts:write." }
}Rotation
Create the new key, deploy it, check lastUsedAt on the old key, then revoke the old one. Revocation applies on the next request. If a key leaks, revoke it first. See errors and rate limits for the other error types.