The profile API accepts an OAuth access token or a one-time displayed lid_live_ API key. This example intentionally uses a placeholder. The raw API key is never returned by list or status endpoints.
cURL
curl https://identity.lucionglobal.com/api/v1/me \n -H 'Authorization: Bearer YOUR_API_KEY_OR_ACCESS_TOKEN'Safe response handling
const response = await fetch("https://identity.lucionglobal.com/api/v1/me", {
headers: { Authorization: `Bearer ${process.env.LUCION_TOKEN}` }
});
const requestId = response.headers.get("X-Request-ID");
const retryAfter = response.headers.get("Retry-After");
const payload = await response.json();
if (!response.ok) throw new Error(`${payload.error || "request_failed"} (request ${requestId || "unavailable"})`);
const profile = payload;
// Retry only a documented safe read, and honor Retry-After when present.For developer control-plane reads, use the same bearer transport with the identity.developer.read scope and a bounded limit/cursor. Collection responses are owner-filtered and metadata-only; pass next_cursor back unchanged.
Developer read
curl "https://identity.lucionglobal.com/api/v1/developer/applications?limit=25" \
-H 'Authorization: Bearer YOUR_DEVELOPER_READ_TOKEN' \
-H 'X-Lucion-API-Version: v1'| Credential | Use | Boundary |
|---|---|---|
| OAuth access token | User-authorized API calls | Validate issuer, audience, expiry, and scopes |
| lid_live_ API key | Scoped server-to-server profile access | Store only in a server secret manager |
| Browser session | Lucion-hosted browser flows | Secure HttpOnly cookie; do not send from backend integrations |