Authentication - LowerPlane Documentation

Overview

All LowerPlane API endpoints under /api/v1/external/ are authenticated with organization API keys. Every request must include your key as a Bearer token in the Authorization header.

Authorization: Bearer lp_your_api_key_here

Creating an API Key

Log in to the LowerPlane dashboard
Go to Settings > API Keys
Click Create API Key, give it a descriptive name (e.g., “CI/CD Pipeline”), and optionally set an expiration date
Copy the key immediately — it is shown only once

All API keys start with the lp_ prefix. Keys are stored hashed; LowerPlane cannot recover a lost key, so you’ll need to create a new one if it’s misplaced.

Using Your Key

curl https://app.lowerplane.com/api/v1/external/assets \
  -H "Authorization: Bearer lp_your_api_key"

import requests

response = requests.get(
    "https://app.lowerplane.com/api/v1/external/assets",
    headers={"Authorization": "Bearer lp_your_api_key"},
)

Scope

API keys are scoped to your organization. All resources created, read, updated, or deleted through the API belong to the organization that owns the key. A key cannot access data from any other organization.

Rate Limiting

API requests are rate limited per IP address using a sliding window. When the limit is exceeded, the API responds with 429 Too Many Requests:

{
  "error": "Too many requests",
  "retryAfter": "2026-07-30T12:15:00.000Z"
}

Every response includes standard rate limit headers so you can track your usage:

Header	Description
`RateLimit-Limit`	Maximum requests allowed in the current window
`RateLimit-Remaining`	Requests remaining in the current window
`RateLimit-Reset`	Seconds until the window resets

Handling 429 responses

Wait until the time indicated by retryAfter (or RateLimit-Reset) before retrying
Use exponential backoff with jitter for automated clients
Batch or paginate requests instead of polling item-by-item — for example, use GET /external/assets?limit=100 rather than fetching assets one at a time

If you’re building a high-volume integration and consistently hit rate limits, contact [email protected] to discuss limits for your organization.

Error Responses

Status	Error	Description
401	`Missing or invalid Authorization header`	No `Authorization: Bearer ...` header was sent
401	`Invalid API key format`	The key doesn’t start with `lp_`
401	`Invalid or revoked API key`	The key doesn’t exist or has been deactivated
401	`API key has expired`	The key’s expiration date has passed
429	`Too many requests`	Rate limit exceeded — see Rate Limiting

Security Best Practices

Never commit keys to source control. Use environment variables or a secrets manager (e.g., GitHub Actions secrets, AWS Secrets Manager).
Set expiration dates on keys used for short-lived projects.
Use one key per system so a compromised key can be revoked without breaking other integrations.
Revoke unused keys from Settings > API Keys.

​Overview

​Creating an API Key

​Using Your Key

​Scope

​Rate Limiting

​Handling 429 responses

​Error Responses

​Security Best Practices

Overview

Creating an API Key

Using Your Key

Scope

Rate Limiting

Handling 429 responses

Error Responses

Security Best Practices