Before you start

You need a key. To create one, see Create and revoke a Loopster API key. This article does not repeat the form.
The API base URL is https://app.loopster.ai/api. Every endpoint path starts with /v1.

How do I send my key with a call?

Send the key as a Bearer token in the Authorization header:

Authorization: Bearer loopster_sk_…

A Loopster API key starts with loopster_sk_. Send it in this header. Do not put it in a URL.

To test a key, call GET /v1/key. For example:

curl https://app.loopster.ai/api/v1/key \  -H "Authorization: Bearer loopster_sk_…"

Answers are JSON. A successful answer has success: true. A failed one has success: false and an error message. Some failed answers also carry a code that your code can check, for example key_expired.

How do I check which key I am using?

Call GET /v1/key with the key you want to check. The answer has success: true and a key object with these fields:

id and name: which key this is.
role: member, editor or admin.
canSpend: true or false.
createdAt: when the key was created.
expiresAt: when the key stops working. It is null if the key never expires.
lastUsedAt: when the key was last used. It can be null.

The answer never includes the key itself or its hash. Any role can call GET /v1/key.

Use it to check a key's role, to read its expiresAt before the key ends, or to confirm that a tool sends the key you expect.

If you call GET /v1/key with a token from an MCP sign-in, you get a 400. That token is not an API key.

Which workspace does a key work in?

A key belongs to one workspace. It works in that workspace only.

You do not put a workspace id or slug in the URL. No endpoint takes one. The key decides which workspace you work in.
A call that reaches for another workspace's data is refused. You get a 403. For some items, such as jobs, exports, folders and workbooks, you get a 404 (not found) instead.
The Loopster API page lists the keys for this workspace. A workspace's own settings page lists its keys too. To find it, open Settings, then Workspaces, and click the workspace.
If you work in more than one workspace, you need a key in each one.

What can each role do?

A key has one role. The create form offers three:

Member — read only
Editor — read, write and run
Admin — everything an API key can do

In the API, the roles are called member, editor and admin. GET /v1/key shows which one your key has.

If a call needs more than your key's role allows, the API answers 403. The body then has requiredRole (the role the call needs) and role (the role your key holds).

These examples show calls and the role they need. It is not a full list.

member: list a table's schedules, and start an export.
editor: create, list and revoke share links; import a file; create a folder or workbook; move a workbook; restore an item from Trash; create, change or delete a schedule; and publish a function as a dry run.
admin: publish a function live, open a function to agents (PUT /v1/functions/{functionId}/agent-access), and delete a published function.

The same roles apply over MCP. For example, the set_function_agent_access tool needs an admin key, and create_share_link needs an editor key.

Give each key the least access its tool needs.

What happens when a key expires?

You choose a key's expiry when you create it: Never expires, Expires in 30 days, Expires in 90 days or Expires in 1 year. You cannot change it later.

You can see when a key ends in two places. The key list shows when each key expires. GET /v1/key returns it as expiresAt, which is null for a key that never expires.

When a key is past expiresAt, it stops working. Calls that use it are refused with a 401. The body has code: key_expired, and the error text includes the expiry date.

A schedule made with the key pauses too. If the key expires before the schedule fires, the schedule pauses by itself and its pausedReason is key_expired.

To avoid a gap, replace a key before it ends. The next section shows how.

How do I rotate a key?

To rotate a key, create a new key, switch your tool to it, and then revoke the old key. Each key can be revoked on its own, so you can do these steps in order and revoke the old key last.

Open Settings, then Loopster API.
Under Create a key, create the new key. Give it a name you can tell apart from the old one, and pick its role and expiry. For the form, see Create and revoke a Loopster API key.
Put the new key in your tool or secret store. The key list shows only the last four characters of a key, so do not count on finding the full key there later.
Test the new key with GET /v1/key. Check the name, role and expiresAt in the answer.
Switch your tool to the new key and run the tool once.
Find the old key's row and look at when it was last used. If that is after the day you switched, something still uses the old key.
Click Revoke on the old key's row.

How do I revoke a key?

Open Settings, then Loopster API, and find the key you want to revoke.
Click Revoke on the key's row.

Each key can be revoked on its own, so your other keys are not changed. A tool that still sends the revoked key stops working, so switch it to a new key first.

A schedule made with a key pauses by itself if you revoke that key. Its pausedReason is then key_revoked. After you revoke a key, check the schedules it made. To list a table's schedules, call GET /v1/tables/{tableId}/schedules. Any role can list them. A schedule that you start again spends from your wallet every time it fires.

What do I do if a key leaks?

Revoke the key at once. Open Settings, then Loopster API, and click Revoke on its row. Tools that use it stop working until you switch them to a new key.
Create a new key and switch your tools to it. See "How do I rotate a key?" above.
Look for spend you do not recognize. GET /v1/usage shows what the workspace spent, by table, by column or by day. GET /v1/wallet shows the wallet balance. In the app, see See where your spend goes on the Usage page.
Check the schedules the key made. GET /v1/tables/{tableId}/schedules lists a table's schedules. A schedule paused by the revoke shows pausedReason key_revoked.

How do I keep my keys secret?

The Loopster API page says: "Each key has a name and a role, and can be revoked on its own. Keep them secret; do not share them publicly."

Treat a key like a password. Keep it in your tool's secret settings or in an environment variable. Do not paste it into chat, tickets, public code or screenshots.
Make one key for each tool and name it after the tool. The text under Create a key says: "Name it after what will use it. Give it the least access that integration needs." Then you can revoke one key without touching the others.
Give a key an expiry if it does not need to last. A key with an expiry stops working on its own date, so a leaked key does not stay useful forever.
A table's webhook address is a separate secret, not an API key. POST /v1/webhooks/{secret} takes no Authorization header. The secret in the address is the credential, so anyone who holds it can add rows to that table. To replace the address, call POST /v1/tables/{tableId}/webhook/rotate with an editor key. The old address stops working at once. The new address is shown only in that answer.

The warning under the API key format heading on the Authentication page in the Loopster API docs: Keep your API keys private. Anyone with a key can do whatever its role allows in your workspace.

Which calls can spend from my wallet?

Some calls start paid work. The cost comes from your Loopster wallet. All workspaces in your organization share one wallet. A spend limit, if you set one, is per workspace.

These calls can start paid work. The MCP tool is in brackets.

POST /v1/tables/{tableId}/trigger (trigger_rows), unless it is a dry run. Without rowIds it runs every row.
POST /v1/functions/{functionId}/runs (run_function).
POST /v1/capabilities/{templateId}/runs (run_capability), unless it runs on your own connection.
POST /v1/tables (create_table) with a paid starter. A blank, webhook or search table is free.
POST /v1/tables/{tableId}/rows (insert_rows) and a table's webhook address, when the table has autoplay on.
PATCH /v1/tables/{tableId}/rows/{rowId} and PATCH /v1/tables/{tableId}/cells (update_row, update_cells). On a table with auto-rerun columns, writing a cell re-queues the columns that read it.
POST /v1/tables/{tableId}/schedules (create_schedule). A schedule spends every time it fires, until it is paused or deleted. update_schedule with paused: false starts one again.

autoplay is a table setting. With it on, rows you insert are queued for processing. With it off, an insert only writes rows. GET /v1/tables/{tableId} shows the setting.

To price a trigger before you run it, add ?dryRun=true to the call. Nothing is queued and nothing is charged. The answer shows maxCostUsd, which is a ceiling, not a forecast. The MCP tool is estimate_trigger_cost.

If your wallet cannot cover even the first row of paid work, the call is refused with a 402 before anything is queued. If it covers only part of a big run, rows run in order while it covers them. The rest are refused and not charged. The code in a 402 tells you which limit refused the call:

insufficient_balance: the wallet cannot cover it. Top up, or ask for less.
workspace_limit: the workspace's own spend limit leaves less than the wallet. Raise the limit, or ask for less.
daily_cogs_limit: the account reached its daily spend safety limit. Topping up does not lift it. It resets at midnight UTC, and Loopster support can raise it.

To top up, click the wallet button at the top right, then Manage wallet, then Top up. To change a workspace's limit, open Settings, then Workspaces, click the workspace and use Set spend limit. See Your wallet and keeping spend under control and Workspaces: create one and set a spend limit.

Can I create, rotate or revoke a key through the API?

No. The API has one call about keys, GET /v1/key, and it returns details of the key you send. There is no call that creates, rotates or revokes a key, and the MCP server has no tool for it either. You do these in the app, under Settings, then Loopster API.

Troubleshooting

My call returns 401 with key_expired

What you see: A 401. The body has success: false, an error message with a date, and code: key_expired.

Why it happens: The key is past its expiry date. A key past expiresAt stops working.

What to do: Create a new key under Settings, then Loopster API, and switch your tool to it. See "How do I rotate a key?" above.

My call returns 401 and there is no key_expired code

What you see: A 401 without code: key_expired.

Why it happens: The API answers 401 when a call does not carry a key.

What to do: Send Authorization: Bearer loopster_sk_… with every call. Check that your tool really sends the header. If the header is there and the call still fails, test the key with GET /v1/key, or create a new key and switch your tool to it.

My call returns 403 and the body has requiredRole

What you see: A 403. The body has requiredRole and role.

Why it happens: The call needs a higher role than your key has. requiredRole is the role the call needs. role is the role your key holds.

What to do: Use a key whose role is requiredRole or higher. To get one, create a new key with that role. GET /v1/key shows the role of the key you are using.

My call returns 403 and the body has no requiredRole

What you see: A 403 without requiredRole.

Why it happens: The call is not allowed, and the reason is not the key's role. The reasons the API lists include that the item belongs to another workspace, and that the table's API is disabled.

What to do: Check that the key and the item are in the same workspace. A key works in one workspace only. If the table's API is disabled, the API cannot switch it on for you. See Contact support if you need help. If neither applies, test the key with GET /v1/key. If that call is refused too, create a new key and switch your tool to it.

GET /v1/key returns 400

What you see: A 400 from GET /v1/key.

Why it happens: A token from an MCP sign-in is not an API key, and GET /v1/key answers 400 to it.

What to do: Check which token your tool sends. Send an API key instead. Create one under Settings, then Loopster API.

My call returns 402

What you see: A 402 on a call that starts paid work. The body has a code, requiredUsd and spendableUsd.

Why it happens: The wallet cannot cover the work, or a limit refused it. Nothing was created, queued or charged. The code says which: insufficient_balance, workspace_limit or daily_cogs_limit.

What to do: Follow the code as described in "Which calls can spend from my wallet?" above.

I lost a key

What you see: A tool needs a key and you no longer have it.

Why it happens: The key list shows each key with only its last four characters.

What to do: Create a new key, switch your tool to it and revoke the lost key. See "How do I rotate a key?" above.

A schedule paused by itself

What you see: A schedule stopped firing. Its pausedReason is key_revoked or key_expired.

Why it happens: The key that made the schedule was revoked, or it expired before a firing. pausedReason is null for a schedule that someone paused by hand.

What to do: Check whether you still need the schedule. To start it again, send paused: false with PATCH /v1/tables/{tableId}/schedules/{scheduleId}. This needs an editor key. The schedule then spends from your wallet every time it fires.

Good to know

The API Docs link at the bottom of the Settings left menu opens docs.loopster.ai. The docs page on Authentication covers the header. The full API description is at https://app.loopster.ai/openapi.json.
Keys that let other tools use Loopster are under Loopster API. Keys for services Loopster runs on, like Apollo, are in Connections. They are different keys.
The Loopster MCP server is at https://app.loopster.ai/api/mcp. You can send an API key to it in the same Authorization: Bearer header. Its tools work in the one workspace that owns the key.

More about the API and MCP

Use, rotate and revoke a Loopster API key