Tokens and authentication

Apps authenticate with a bot token. Webhooks don't use tokens: their secret URL is the credential (see Webhooks).

#Bot tokens

A token looks like this:

lmb1_1234567890123456789_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789abcdefg

Send it on every REST request in the Authorization header, with the word Bot in front:

GET /v1/users/@me HTTP/1.1
Host: lammapp.sa
Authorization: Bot lmb1_…

On the gateway, send it in the identify message instead (see Gateway).

• Tokens work only on /v1. Lamma refuses a bot token everywhere else, and ignores sign-in cookies on /v1.
• Lamma stores only a hash of the secret part, so it can't show a token again. Copy it when it is made.
• A missing token answers 401 bot_token_required, a wrong or revoked one 401 bot_token_invalid, and a token for a switched-off or deleted app 403 application_disabled.

#Resetting a token

In User Settings › Developer, open the app and select Reset token. For safety, this needs a sign-in within the last ten minutes.

At most two tokens are live at once. After a reset, the previous token keeps working for one hour, so a running bot can switch over without going offline. To cut off every token at once, select Revoke all tokens: open gateway connections close within ten seconds.

#Session cookies and the product API

Lamma's own app uses routes under /api/ with a sign-in cookie. Those routes are for people, not bots: they aren't part of this API and can change at any time. The only /api/ routes meant for developers are the webhook URLs.