Skip to main content

Security & API Keys

Lumio has separate credentials for extension publishing and channel API access. Use a developer key (lm_dev_*) for the lumio CLI and CI publishing; it belongs to your developer profile or team and carries extension-dev:* scopes. A personal API key (lm_usr_*) belongs to you within a channel and carries the channel permissions you select.

API keys​

Developer keys are the normal credential for:

  • The lumio CLI (lumio login --token <key>)
  • CI/CD pipelines running lumio deploy
  • Direct calls to the Developer REST API

Creating a key​

  1. Open lumio.vision
  2. Navigate to Settings → You → Developer → Developer keys (/dashboard/settings/developer/keys)
  3. Click Create developer key
  4. Enter a label (e.g. ci-github-actions)
  5. Select the permissions the key should carry
  6. Optionally set an expiry
  7. Copy the key - it is shown only once

Developer keys are prefixed with lm_dev_. Lumio stores only a hash of the key, so the full secret cannot be recovered after creation. To create a channel-scoped personal key instead, choose Settings → Channel → Access → API Keys (/dashboard/settings/channel/api-keys).

Key permissions​

Each API key carries the permissions selected at creation time. A key can never grant more permissions than the user who creates it; the backend rejects any permission the creator does not currently hold.

Revoking a key​

Revoke a developer key from Settings → You → Developer → Developer keys. Revocation hard-deletes the key, so it cannot be restored.

Rotation recommendation​

Rotate API keys every 90 days or immediately when:

  • A team member with access to the key leaves
  • You suspect the key may have been exposed
  • You rotate secrets in your CI/CD platform

Teams and shared access​

Multiple developers can collaborate on extensions via developer teams. Each team member authenticates with their own credentials -- shared passwords or shared API keys are not needed or recommended.

Teams use a full RBAC system with 18 granular permissions across 7 categories. Three default roles (Owner, Admin, Member) are created for every team, and custom roles can be added. See Roles & Permissions for the complete permission reference.

Two-factor authentication​

Open Settings → You → Security → Sign-in to manage 2FA for your Lumio profile. You can keep up to five authenticator apps (TOTP) and ten passkeys together. A passkey can also sign you in without a password and satisfy a pending second step. Save the ten recovery codes shown with your first method; each works once. Adding more methods does not replace them. Use a passkey, app code or recovery code when Lumio asks you to confirm a sensitive action.

You can publish extensions without enabling 2FA, but securing your developer account with at least one method is recommended. See Account Security for setup and recovery.

Audit log​

Open Settings → You → Security → Activity (/dashboard/settings/security/activity) for your personal sign-in, identity confirmation and developer-key lifecycle events. The channel-wide audit log is a separate area under Settings → Channel → Control → Audit log (/dashboard/settings/channel/audit-log) and requires audit-log:read. See the product audit-log guide for filtering, exports and retention.

Responsible disclosure​

If you discover a security vulnerability in the Lumio platform, report it to security@lumio.vision. Include a description of the issue, steps to reproduce, and impact assessment. We follow a 90-day disclosure timeline and offer recognition in our security hall of fame for valid reports.

Do not report vulnerabilities via GitHub issues or the public support channel.

Security best practices​

  • Store API keys in your CI/CD secret store (GitHub Actions secrets, GitLab CI variables), never in source code
  • Use environment-specific keys - a separate key for staging vs production deployments
  • Enable 2FA on your developer account
  • Review the audit log monthly for unexpected access
  • Revoke keys that are no longer in use
  • Never share your API key in support tickets, Discord, or forums - Lumio staff will never ask for your key