​
Overview

All LowerPlane API endpoints under /api/v1/external/ are authenticated with organization API keys. Every request must include your key as a Bearer token in the Authorization header. 
Authorization: Bearer lp_your_api_key_here

​
Creating an API Key

  1. Log in to the LowerPlane dashboard
  2. Go to Settings > API Keys
  3. Click Create API Key, give it a descriptive name (e.g., “CI/CD Pipeline”), and optionally set an expiration date
  4. Copy the key immediately — it is shown only once
All API keys start with the lp_ prefix. Keys are stored hashed; LowerPlane cannot recover a lost key, so you’ll need to create a new one if it’s misplaced.

​
Using Your Key

curl https://app.lowerplane.com/api/v1/external/assets \
  -H "Authorization: Bearer lp_your_api_key"

import requests

response = requests.get(
    "https://app.lowerplane.com/api/v1/external/assets",
    headers={"Authorization": "Bearer lp_your_api_key"},
)

​
Scope

API keys are scoped to your organization. All resources created, read, updated, or deleted through the API belong to the organization that owns the key. A key cannot access data from any other organization.

​
Rate Limiting

API requests are rate limited per IP address using a sliding window. When the limit is exceeded, the API responds with 429 Too Many Requests: 
{
  "error": "Too many requests",
  "retryAfter": "2026-07-30T12:15:00.000Z"
}
Every response includes standard rate limit headers so you can track your usage:
HeaderDescription
RateLimit-LimitMaximum requests allowed in the current window
RateLimit-RemainingRequests remaining in the current window
RateLimit-ResetSeconds until the window resets

​
Handling 429 responses

  • Wait until the time indicated by retryAfter (or RateLimit-Reset) before retrying
  • Use exponential backoff with jitter for automated clients
  • Batch or paginate requests instead of polling item-by-item — for example, use GET /external/assets?limit=100 rather than fetching assets one at a time
If you’re building a high-volume integration and consistently hit rate limits, contact support@lowerplane.com to discuss limits for your organization.

​
Error Responses

StatusErrorDescription
401Missing or invalid Authorization headerNo Authorization: Bearer ... header was sent
401Invalid API key formatThe key doesn’t start with lp_
401Invalid or revoked API keyThe key doesn’t exist or has been deactivated
401API key has expiredThe key’s expiration date has passed
429Too many requestsRate limit exceeded — see Rate Limiting

​
Security Best Practices

  • Never commit keys to source control. Use environment variables or a secrets manager (e.g., GitHub Actions secrets, AWS Secrets Manager).
  • Set expiration dates on keys used for short-lived projects.
  • Use one key per system so a compromised key can be revoked without breaking other integrations.
  • Revoke unused keys from Settings > API Keys.