Authentication and API keys
Loresta uses workspace-scoped bearer keys for REST and MCP. Keys use the lsk_live_... format in normal workspaces and lsk_test_... in local demo mode.
Create a key
Section titled “Create a key”Workspace owners and administrators create keys from Developer settings. An active paid workspace is required.
| Setting | Contract |
|---|---|
| Name | 3 to 80 characters |
| Lifetime | 1 to 365 days, 90 days by default |
| Active key limit | 10 per workspace |
| Secret visibility | Shown once at creation or rotation |
| Stored credential | Prefix and SHA-256 hash, never the raw key |
Send the bearer token
Section titled “Send the bearer token”Authorization: Bearer lsk_live_your_keyKeep the key in an encrypted server-side secret manager. Do not place it in browser JavaScript, mobile application bundles, query strings, analytics properties, support screenshots, or source control.
Scopes
Section titled “Scopes”| Scope | Grants |
|---|---|
persona:read |
Approved creator persona and offer facts |
usage:read |
Current monthly allowance and privacy-minimal operation totals |
replies:write |
Classify an inbound message and prepare a reply decision |
handoffs:write |
Queue a confirmed handoff for an existing Loresta conversation |
Tool and route visibility is reduced to the scopes on the key. Use separate keys for separate environments or services.
Rotate and revoke
Section titled “Rotate and revoke”Rotation creates a new secret with the selected scopes and expiry, then revokes the previous key. Update the consuming service before discarding the one-time secret.
Revoked, expired, malformed, or unknown keys receive HTTP 401. Keys also stop working when the workspace is not active or paid.
Browser-origin protection
Section titled “Browser-origin protection”Server-to-server requests normally omit the Origin header. When a browser sends one, Loresta accepts only configured origins and rejects others with agent_origin_rejected. This protection does not make it safe to ship a bearer key to a browser.
Authentication checklist
Section titled “Authentication checklist”- Give every key one service and environment owner.
- Select the minimum scopes.
- Use short expirations where rotation is automated.
- Rotate after a provider or operator change.
- Revoke immediately when exposure is suspected.
- Record
x-request-idwhen investigating a failed request.