Overview

API tokens let your external integrations (scripts, ERPs, warehouse systems, or AI tools) authenticate with the Luminous External API. Each token is tied to a user account and is presented as a Bearer token on every API request. Tokens are created and deleted from the Luminous settings page — there is no expiration, so managing your active token list is important for security.

Where to find API Tokens

  1. Click your name in the top-right corner and choose Settings.
  2. In the Settings menu, under Integrations, click API Tokens.

The page lists all tokens your account has created, showing a masked version of each token (only the first four and last four characters are visible).

Creating a new token

  1. Click Create API Token.
  2. In the Create New API Token dialog:
    • Token Label (required): a name that identifies the token's purpose, e.g. Warehouse WMS.
    • Restrict customer PII on External API (optional, off by default): when on, External API responses omit or hash addresses, emails and phone numbers for this token. This can't be changed later.
  3. Click Create Token, then copy the full token right away — it's only shown once.

Copy your token immediately

After creation, a confirmation screen shows the full token value. This is the only time the complete token is displayed. Copy it now and store it in a password manager or environment variable. Once you dismiss this screen, only the masked version will be visible.

If you navigate away without copying the token, you will need to delete it and create a new one.

Using your token in API requests

Pass the token as a standard HTTP Bearer token in the Authorization header of every External API request:

Authorization: Bearer <your-token>

Requests without a valid token — or with a deleted token — receive a 401 Unauthorized response.

Connecting to the Luminous MCP server (AI tools)

You don't need an API token to connect Claude. Click Add MCP Server on the API Tokens page and follow the steps: in Claude, go to Settings → Connectors → Add custom connector, paste https://mcp.joinluminous.com/mcp, then sign in with your Luminous account. The older token-based setup still works, but the connector is the recommended way.

Viewing existing tokens

The list shows each token's Label, Customer PII setting (Full or Restricted), masked Token (first and last four characters), Created date, and a Delete action.

Deleting a token

To revoke a token:

  1. Find the token in the API Tokens list.
  2. Click the Delete (trash) icon next to it.
  3. Confirm the deletion in the dialog.

Deletion is immediate. Any integration still using that token will receive 401 Unauthorized responses from that point forward. Update your integration with a new token before deleting the old one to avoid downtime.

Best practices

  • Use descriptive labels so your team can tell which token belongs to which system without needing to see the value.
  • Store tokens securely — never in email, Slack messages, or source code repositories. Use environment variables or a secrets manager.
  • Enable PII restriction for any integration that does not have a documented need for raw customer contact data.
  • Delete tokens you no longer use to reduce your security exposure.
  • Rotate tokens regularly, especially when team members with access to the token leave the organization.
  • Create a replacement token first, then update your integration, then delete the old token — this avoids a gap in service.