Authentication

Every request carries Authorization: Bearer <access token>. Tokens come from Zitadel at https://id.asklucy.eu.

Caller	Flow
A person in your app	Authorization code with PKCE, through your company’s identity provider
Your backend	A Zitadel service user of your organisation, using client credentials or JWT profile

Lucy has no API keys, passwords or sign-up endpoints of its own.

The token decides the organisation and permissions. Roles (member, org_admin, auditor) come from the urn:zitadel:iam:org:project:roles claim; each operation in the reference lists the roles it needs.

Caution

Every object belongs to exactly one organisation. An ID from another organisation returns 404, as if it did not exist.

Ask your Ask Lucy contact to create a service user for your organisation.