Getting Started

Authentication

All API requests are authenticated with an API key.

API keys

Create API keys from the API Keys page in your dashboard. Each account can have multiple keys — useful for separating environments (development, staging, production) or giving different services their own key that can be revoked independently.

Keys are shown once. Copy your API key immediately after creation — it cannot be retrieved again. If you lose it, revoke it and create a new one.

Sending your key

Include your key in the Authorization header on every request:

Authorization: Bearer inv_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

Full example with curl:

curl https://api.lumiparser.com/v1/invoices \
  -H "Authorization: Bearer inv_live_YOUR_KEY"

Key format

Prefix	inv_live_
Length	41 characters total
Storage	SHA-256 hashed — we never store the plaintext
Display	inv_live_abcd1234••••••••

Rate limits per key

Rate limits are enforced per API key using a sliding window. Each response includes headers showing your current status:

X-RateLimit-Limit: 60        # requests allowed per minute
X-RateLimit-Remaining: 58   # requests left in current window
X-RateLimit-Reset: 1706000000  # Unix timestamp when window resets

Plan	Rate limit	Monthly quota
Free	20 req/min	20 documents
Starter	60 req/min	500 documents
Pro	120 req/min	5,000 documents
Business	300 req/min	25,000 documents

Key management endpoints

# Create a key
POST /v1/keys
{ "name": "Production" }

# List all keys
GET /v1/keys

# Revoke a key
DELETE /v1/keys/:id

Revoking a key is immediate — any app using that key will receive 401 UNAUTHORIZED on the next request.

Unauthenticated endpoints

These two endpoints do not require an API key:

GET /health — server health check
POST /v1/billing/webhook — Stripe webhook (uses signature verification instead)