API basics
The Lovable API lets you manage and deploy existing projects automatically from backend code. You need a Business or Enterprise plan and a secret key to authenticate your requests.
Workspace admins or owners who want to automate project management and deployment from external servers or scripts.
Do this, in order
- 1
Verify your Lovable account email address.
The API will reject all requests if the account email is not verified.
- 2
Go to Workspace settings, select API keys & OAuth, and create a workspace access token.
Every API request requires an authentication key starting with lov_.
- 3
Send your HTTP requests to https://api.lovable.dev/v1/ from a secure server or tool like Postman, never from client-side browser code.
Putting secret API keys in browser code exposes them to anyone visiting your site.
- 4
Add the Lovable-API-Key header and set the Lovable-Version header to a specific version date.
Pinning an explicit version date prevents future updates from breaking your integration.
Paste this into your project
Create a secure backend Edge Function called manage-lovable that receives an action from the client, reads the LOVABLE_API_KEY from environment secrets, and calls https://api.lovable.dev/v1/workspaces with the headers 'Lovable-API-Key: Bearer' and 'Lovable-Version: 2026-09-11', returning the parsed response.
Words decoded
- API
- A standardized way for external programs and scripts to talk to a service and control it automatically.
- Rate limit
- A cap on how many requests you can make in a given timeframe to prevent system overload.
- Cursor pagination
- A technique for retrieving long lists of items in chunks using a unique marker instead of page numbers.
- Idempotent
- An action that produces the exact same result no matter how many times you repeat it.
Where people get stuck
- Never use Lovable API keys in client-side frontend code because visitors can inspect the network tab and steal your credentials.
- Do not expect to prompt or build apps using this API; public API endpoints only manage and deploy existing projects.
- API key creation requires an owner or admin role on a Business or Enterprise workspace plan.
- Be careful when retrying failed POST requests because actions like publishing may trigger a second time.
The short version, steps, decoder and prompt on this page are written automatically from Lovable's own documentation and can lag or misread it. The official page is always the authority.