Lumail
Sign up

Create an API Token

Step-by-step guide to generating API tokens for authenticating your Lumail API requests.

This tutorial walks you through creating an API token in Lumail. API tokens allow your applications, integrations, and automations to securely access your organization's data.

Why use API tokens?

  • Programmatic access — Automate subscriber management, send emails, and sync data from your applications.
  • Secure authentication — Tokens are scoped to your organization and can be revoked anytime.
  • Integration ready — Connect Lumail with tools like Make.com, Zapier, n8n, or your custom backend.
  • No user credentials — Keep your account secure by using tokens instead of username/password.

Prerequisites

  • A Lumail account with an organization.
  • Owner or admin role in the organization.

Step 1 — Navigate to API Keys

  1. Log in to your Lumail dashboard.
  2. Click on API Keys in the sidebar.
  3. Click the Generate API Key button.

Generate token button

Step 2 — Name your token

Give your token a descriptive name to identify its purpose:

  • Production API — For your production application
  • Development — For local development and testing
  • Zapier Integration — For Zapier automation
  • Webhook Handler — For processing workflow webhooks

Name your token dialog

Click Create to generate your token.

Step 3 — Copy and save your token

Your token will be displayed only once. Copy it immediately and store it securely.

Token created dialog

The token format is lum_ followed by a 64-character string:

lum_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6

Store it in your environment variables:

# .env.local (never commit this file)
LUMAIL_API_TOKEN=lum_your_token_here

Step 4 — Use your token

Include the token in the Authorization header of your API requests:

const response = await fetch("https://lumail.io/api/v1/subscribers", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.LUMAIL_API_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    email: "[email protected]",
    name: "Jane Doe",
    tags: ["newsletter"],
  }),
});

const data = await response.json();
console.log(data);

Security best practices

  1. Never commit tokens to version control — Use environment variables or secret managers.
  2. Use separate tokens — Create different tokens for development, staging, and production.
  3. Rotate tokens regularly — Generate new tokens periodically and delete old ones.
  4. Delete unused tokens — Remove tokens you no longer need from the settings page.

Managing tokens

To view, or delete existing tokens:

  1. Go to API Keys.
  2. View all active tokens with their creation dates.
  3. Click the delete icon to revoke a token.

Deleting a token immediately revokes access — any applications using it will fail authentication.

PreviousEnable Double Opt-InNextSend Transactional Email with SMTP