Agent API quickstart

This guide uses the public REST API. The same key can authenticate the Loresta MCP server.

Prerequisites

• An active paid Loresta workspace
• An active creator profile in that workspace
• Owner or administrator access to Developer settings
• A server-side secret manager for the API key

Create a scoped key

Open Developer settings, give the integration a descriptive name, choose the shortest useful lifetime, and select only the scopes it needs. Start with persona:read and usage:read when you do not need drafting or handoffs.

Loresta shows the complete key once. Store it immediately. Only the prefix remains visible in the dashboard.

Set server-side variables

export LORESTA_AGENT_KEY="lsk_live_your_key"
export LORESTA_PROFILE_ID="cr_your_profile"

The v1 API does not include a public profile-list endpoint. Obtain the active profileId from the Loresta workspace owner or the workspace integration setup context. Do not guess profile IDs or discover them through private dashboard routes.

Read approved creator context

curl "https://loresta.co/api/v1/agent/persona?profileId=$LORESTA_PROFILE_ID" \
  -H "Authorization: Bearer $LORESTA_AGENT_KEY"

This returns approved non-secret persona fields and offer facts. It does not return provider credentials, private message history, or supporter memory.

Prepare a reply decision

curl "https://loresta.co/api/v1/agent/draft" \
  -X POST \
  -H "Authorization: Bearer $LORESTA_AGENT_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: draft-20260826-0001" \
  --data '{
    "profileId": "cr_your_profile",
    "message": "Where can I find your editing guide?"
  }'

Inspect decision.riskLevel and decision.requiresCreator. A safe decision can include a prepared reply. A review or blocked decision needs creator judgment. Loresta does not send the returned text.

Handle the response safely

1. Treat requiresCreator: true as a stop condition.
2. Never turn rationale into follower-facing copy.
3. Reuse the same idempotency key only when retrying the identical request.
4. Log the response x-request-id for support, but do not log the bearer key or private message bodies.

Continue with authentication and key management or review errors and limits.