API basics

1. 1

   Go to 'Settings → Access tokens' in your Lovable account.

   This is where you create and manage your API keys, which are essential for authenticating your requests.

2. 2

   Create a new API key.

   You need a unique key to identify your requests and ensure they are authorized. Make sure your account email is verified, and you have a Business or Enterprise plan with owner/admin role.

3. 3

   Copy your new API key, which starts with 'lov_'.

   You will include this key in every request you send to the Lovable API.

4. 4

   When making an API request, include your copied API key in a header called 'Lovable-API-Key'.

   This header tells the Lovable API who you are and allows your request to be processed.

5. 5

   Add a 'Lovable-Version' header with a date like 'YYYY-MM-DD' (e.g., '2026-09-11') to your requests.

   This ensures your requests use a specific, stable version of the API, preventing unexpected changes if the API updates.

6. 6

   If your request includes data in the body (like when creating or updating something), set the 'Content-Type' header to 'application/json'.

   This tells the API that the data you're sending is in JSON format, which it expects.

I need to connect my application to the Lovable API. Please provide me with a Lovable API key, and tell me the exact headers I need to include in my requests for authentication and versioning. I will be sending JSON data in some requests. Also, remind me of the base URL.

API

Application Programming Interface. It's a set of rules and tools that lets different software programs talk to each other. Think of it as a menu in a restaurant: it lists what you can order (requests) and what you'll get back (responses).

Base URL

The main web address for the API. All specific requests start from this address.

Endpoint

A specific web address within the API that performs a particular action or provides specific data. For example, '/v1/workspaces' might be an endpoint to get information about your workspaces.

Header

Extra information sent with your request, like a note attached to a letter. It provides context, such as your authentication key or the format of the data you're sending.

Authentication

The process of proving who you are to the API, usually by providing a secret key, so it knows you're allowed to make requests.

Workspace-scoped API key

A secret key that grants access to resources within a specific 'workspace' (like a team or project area) in Lovable.

HTTP methods (GET, POST, PATCH, DELETE)

These are standard actions you can tell a web server to perform: 'GET' to retrieve information, 'POST' to create new information, 'PATCH' to update existing information, and 'DELETE' to remove information.

JSON

JavaScript Object Notation. It's a common, easy-to-read format for sending data between computers, often used by APIs.

Rate limits

Restrictions on how many requests you can send to the API within a certain time period to prevent overuse or abuse.

Pagination

A way to break up long lists of data into smaller, manageable 'pages' so you don't have to download everything at once.

Cursor-based pagination

A specific method of pagination where you get a 'cursor' (a pointer) from one page that tells the API where to start fetching the next page of results.

Eventually consistent

Describes data that might not be immediately up-to-date after a change. It will become consistent (correct) over time, but there might be a short delay.

• Using your API key in browser code, as it should only be used from trusted server-side code or automation tools.
• Forgetting to include the 'Lovable-API-Key' header, which will result in an 'unauthorized' error.
• Not pinning your API version with the 'Lovable-Version' header, which means your requests might unexpectedly use a newer, potentially breaking, API version.
• Sending a JSON body without setting the 'Content-Type: application/json' header, which can cause the API to reject your request.
• Trying to create or edit AI projects directly through the public API, as it's designed for managing and deploying existing projects, not AI creation.
• Ignoring rate limit headers and continuing to send requests after being rate-limited, which will result in '429 Too Many Requests' errors.
• Expecting immediate consistency for all reads after a write; some data might be 'eventually consistent' and take a moment to update.