Authentication
Every request to the Loop API is authenticated with an API key. The key identifies you and determines which team's data you can see — there are no separate usernames, passwords, or OAuth flows.
What a key looks like
Loop API keys are prefixed strings:
lp_live_1gvw09Z2bll0IiN6_oKYX2Dq20G7Qv4ilmFMt4yYs2PdemBMB
The lp_live prefix tells you at a glance that this key touches live data. Test keys, prefixed lp_test, will be introduced alongside our sandbox environment — they'll work identically but against isolated test data.
Treat your key like a password. Anyone who has it can read data through the API as if they were you, so don't paste it into client-side JavaScript, don't commit it to a repository, and don't forward it by email or chat.
Getting a key
API keys are issued by Loop support. Email [email protected], or ask your account manager to do it on your behalf, and let them know:
- Which organisation and team the key is for
- What you're building, in a sentence or two
- Who should receive the key
Once your request is approved, the named recipient receives an email containing the api key.
How keys map to teams
Every API key is tied to a single team or organization. When you make a request, the API knows which team you're acting on behalf of from the key alone — you never pass an team ID separately.
This means:
The data you can see is scoped to that team. Properties, contacts, and other records belonging to other teams won't appear in your responses.
If an organisation has more than one teams and you need data from each, you can either request a separate key per team or ask for a key scoped to an organization.
If a key is rotated or revoked, only that team's integration is affected (if a key is team scoped).
If you're not sure which team your key belongs to, ask Loop support.
Using your key
Send the key in the Authorization header of every request:
Authorization: Bearer lp_live_1gvw09Z2bll0IiN6_oKYX2Dq20G7Qv4ilmFMt4yYs2PdemBMB
Requests without a valid key receive a 401 Unauthorized response.
Looking after your key
A few sensible habits:
- Store keys in environment variables or a secrets manager, never in source code.
- Keep keys server-side. Don't call the API directly from the browser — proxy requests through your own backend so the key never reaches the visitor's machine.
- Rotate immediately if you think a key has leaked. Contact support to revoke the old key and issue a new one; you'll receive the replacement through the same one-time link process.
Updated 4 months ago