Skip to content

Getting started

This page shows you how to get a key, check that it works, and choose the guide for what you want to build.

You need a key. A key starts with lxr_live_. After Luxorr turns on API access for your account, your Administrator creates the key in the Luxorr workspace. You can also ask your Luxorr contact for a key. For more information, see Hosts and keys.

The key is shown only once. Keep it in a secret store. Never put it in source code or a browser.

Terminal window
export LUXORR_API=https://api.luxorr.io/v1
export LUXORR_KEY=lxr_live_...

GET /me returns your key, your account’s setup, and the brands that the key can act for. If the call returns 200, the key works.

Terminal window
curl -s "$LUXORR_API/me" -H "Authorization: Bearer $LUXORR_KEY"
{
"tenant": {
"id": "6f1c2a0e-1d2b-4c3d-8e9f-0a1b2c3d4e5f",
"locales": ["en-US", "de-DE"],
"approvalRequired": false,
"customFields": [
{
"id": "5c4b3a29-1807-4f6e-8d5c-4b3a29180746",
"label": "Customer ID",
"type": "TEXT",
"required": true,
"options": []
},
{
"id": "3d2c1b0a-9f8e-4d7c-8b6a-5f4e3d2c1b0a",
"label": "VIP tier",
"type": "DROPDOWN",
"required": false,
"options": ["Gold", "Platinum"]
}
]
},
"key": {
"name": "CRM journeys",
"scopes": ["PERSONAL_LINKS"],
"webhookUrl": "https://hooks.operator.example/luxorr"
},
"brands": [
{
"id": "0a6f2e1c-3b5d-4e7f-8a9b-0c1d2e3f4a5b",
"name": "Example Brand"
}
],
"environment": "production"
}

The following table describes the fields:

Field Description
tenant.id Your account’s ID. Give this ID when you contact Luxorr.
tenant.locales The languages that you can use, such as en-US and de-DE.
tenant.approvalRequired If true, your team approves each new link and store order before it continues.
tenant.customFields Your own order fields. Links and store orders answer them by id.
key.scopes What the key can do: PERSONAL_LINKS, REWARD_STORES, or both. For more information, see Scopes.
key.webhookUrl Where your events are sent, or null.
brands The brands that the key can act for.

If the key is missing, wrong, or revoked, the API returns 401 invalid_api_key.

Use the following table to find the guide for your task:

To Read
Send a gift link Personal links
Run a rewards shop Rewards stores
Get notified about changes Webhooks and events
Try any call API reference

All calls share these rules:

  • Format. Requests and responses are JSON, with camelCase field names. Languages are tags, such as en-US or de-DE.
  • Times. Times are in UTC, such as 2026-10-05T09:12:44.512731Z. Keep all six decimal places.
  • Pages. Lists return { "items": [...], "nextCursor": "..." }. To get the next page, send nextCursor back as after. limit is 1 to 100, and the default is 25.
  • Retries. A POST call that creates something needs an Idempotency-Key header. For more information, see Idempotency and retries.
  • Errors. Each error has a code that you can use in your logic. If your key can’t access a record, the API returns 404. For more information, see Errors.