Developers

The public API is not accepting keys yet. This page is the contract the server will implement, so the documentation does not drift from the code later.

Authentication

Server-to-server calls send Authorization: Bearer lq_live_…. The secret is shown once. Requests without a valid key fail.

Errors

{
  "error": {
    "code": "QUEST_NOT_AVAILABLE",
    "message": "This quest is no longer available.",
    "requestId": "req_01h..."
  }
}

Idempotency

Send Idempotency-Key when creating a deposit, allocating a reward, or completing a claim. Repeating the same key returns the original result.

Webhooks

Lunor signs timestamp.body with HMAC-SHA256 in the Lunor-Signature header. Reject timestamps older than five minutes and store the event id.