Skip to main content

Authentication

Every request to the Weave API is authenticated with a bearer token in the Authorization header:

curl https://api.loomloyalty.com/customers \
  -H "Authorization: Bearer YOUR_TOKEN"

A request with no valid token receives 401 Unauthorized; a valid token that lacks permission for the operation receives 403 Forbidden.

Who the token represents​

A token identifies one of two kinds of principal:

  • API key — a machine-to-machine client for server-side integrations and automation. This is what most integrations use, and what this guide covers.
  • User — a person signed in through WorkOS SSO, used by first-party surfaces such as the dashboard.

Creating an API key​

API keys are created from the dashboard:

  1. Open Developers → API Keys.
  2. Choose Create API Key, give it a descriptive name, and confirm.
  3. Copy the key that's shown. It looks like llk_<keyId>_<secret> and is displayed only once — store it in a secret manager or environment variable. If you lose it, revoke the key and create a new one.

The llk_<keyId> prefix is the key's public identifier (safe to log); the full llk_<keyId>_<secret> value is the secret you authenticate with.

Keep keys secret

Treat an API key like a password. Use it only from server-side code — never in a browser, mobile app, or public repository. If a key is exposed, revoke it in the dashboard immediately.

Authenticating a request​

Send the API key as the bearer token on every request:

curl https://api.loomloyalty.com/customers \
  -H "Authorization: Bearer llk_<keyId>_<secret>"
const response = await fetch("https://api.loomloyalty.com/customers", {
  headers: {
    Authorization: `Bearer ${process.env.LOOM_API_KEY}`,
  },
});

Managing keys​

  • Scope a key's privileges through its assigned roles (managed from Developers → API Keys) so each integration gets only the access it needs.
  • Rotate keys periodically, and whenever someone with access leaves.
  • Revoke a key the moment it's no longer needed or may be compromised.

Next Steps​