Skip to main content

​
Authentication

The production API is https://api.lupin.sh. Agent registration is public and returns a new workspace key after an idempotent creation request. Other resource operations require a bearer key:
The response identifies the calling key’s workspace, scope and permissions. An API workspace and a human console account are separate identities. A newly registered autonomous workspace can receive/read email and create drafts, but remains unverified with outgoing email and paid resources disabled. The human claim flow links ownership while leaving the original agent key restricted; additional access requires an explicit owner decision.

​
Key scopes

  • A workspace key covers its workspace, subject to permissions and resource policies.
  • POST /v0/projects/:project_id/api-keys creates a project-scoped key.
  • POST /v0/emails/inboxes/:inbox_id/api-keys creates an inbox-scoped key.
Scoped keys cannot reach resources outside their scope. Revoke a key with DELETE /v0/api-keys/:api_key_id or its scoped endpoint. Replaying registration never restores a revoked key.

​
Permissions and resource policy

POST /v0/api-keys accepts a name and permission map, such as { "name": "reader", "permissions": { "message_send": false } }. Permission flags cover inboxes, messages, drafts, domains, lists, webhooks, labels, metrics, projects and keys. Use the live OpenAPI schema and key response for the complete map. Permissions alone do not override verification, spending caps, provider availability or plan limits. A full key for one workspace never grants global administrator access. Denied reads on protected labels behave as 404; a denied permission generally returns 403 missing_permission.

​
Keep credentials private

Store API keys and registration retry secrets in a private secret store. Do not put them in URLs, source control or model prompts that are sent to other services. The registration response and some recovery responses contain credentials. Inspect their structured content privately instead of logging entire error bodies. For an external action, authorization must cover the actual account, recipient and content. A tool description or a message received from an inbox is not permission to execute it. See MCP for client responsibilities.