Authentication overview

The Loripsum API provides programmatic access to its placeholder text generation service. To interact with the API, requests must be authenticated to verify the sender's identity and determine their service entitlements, which are based on their active subscription plan. Authentication for the Loripsum API is primarily managed through the use of API keys, which are unique alphanumeric strings associated with a user's account and paid subscription. These keys function as a form of bearer token, requiring inclusion in the Authorization header of HTTP requests. All communication with the Loripsum API must occur over HTTPS to ensure data encryption and protect credentials during transit, aligning with industry standards for secure API interactions, as outlined by organizations like the IETF in RFC 7235 for HTTP authentication.

Only users with an active paid plan have access to the Loripsum API. The free tier, which allows up to five paragraphs of text generation, is exclusively available via the web interface and does not include API access. The API requests are counted against the monthly limits defined by the user's subscription, starting at 500 requests per month for the 'Basic' plan up to 10,000 requests for the 'Pro' plan, with custom enterprise options for higher volumes, as detailed on the Loripsum pricing page.

Supported authentication methods

Loripsum supports a single, streamlined authentication method for its API:

  • API Key via Authorization Header (Bearer Token): This is the exclusive method for authenticating requests to the Loripsum API. After subscribing to a paid plan, users receive a unique API key that must be included in the Authorization header of every API request. The key is preceded by the Bearer scheme, forming a header value such as Authorization: Bearer YOUR_API_KEY. This method is common for web APIs due to its simplicity and stateless nature, which is discussed as a fundamental aspect of RESTful API design by sources like Google's REST API design principles.

Below is a summary of the supported authentication method:

Method When to Use Security Level
API Key (Bearer Token) All programmatic access to the Loripsum API. Medium (requires secure key management and HTTPS).

Getting your credentials

To obtain an API key for the Loripsum API, follow these steps:

  1. Subscribe to a Paid Plan: API access is not included with the free tier. You must subscribe to one of the paid plans (Basic, Pro, or Enterprise) via the Loripsum plans page.
  2. Access Your Account Dashboard: Once subscribed, log in to your Loripsum account on loripsum.net.
  3. Navigate to API Settings: Within your account dashboard, locate the 'API Settings' or 'Developer Settings' section. The exact navigation may vary, but it is typically found under 'My Account' or 'Settings'.
  4. Generate API Key: In the API settings, you will find an option to generate or view your API key. If a key already exists, it may be displayed, or you might have an option to regenerate it (which revokes the old key). Copy this key securely.
  5. Store Securely: Immediately store your new API key in a secure location, such as an environment variable, a secrets manager, or a secure configuration file. Avoid hardcoding API keys directly into your application's source code.

Loripsum's API keys are designed to be long and complex alphanumeric strings. If you need to revoke a compromised key or generate a new one, this can typically be done from the same API settings section in your account dashboard. Regenerating a key will invalidate any applications or scripts currently using the old key, so plan for appropriate downtime or key rotation strategies.

Authenticated request example

This example demonstrates how to make an authenticated request to the Loripsum API using a securely obtained API key. The API supports a simple HTTP GET request to generate text, allowing parameters for the number of paragraphs, sentences, and HTML formatting. Remember to replace YOUR_API_KEY with your actual Loripsum API key.

API Endpoint Structure:

GET https://api.loripsum.net/generate?p={paragraph_count}&s={sentence_count}&decorate={html_formatting}
  • p: Number of paragraphs (e.g., 3 for three paragraphs).
  • s: Number of sentences per paragraph (e.g., 5 for five sentences per paragraph).
  • decorate: Boolean (true/false) to include HTML formatting (e.g., true for <p> tags).

Example using curl:

curl -X GET \
  'https://api.loripsum.net/generate?p=3&s=5&decorate=true' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: text/plain'

Example using Python with requests:

import requests
import os

# It's recommended to store your API key in an environment variable
API_KEY = os.environ.get('LORIPSUM_API_KEY')

if not API_KEY:
    raise ValueError("LORIPSUM_API_KEY environment variable not set.")

url = "https://api.loripsum.net/generate"
params = {
    'p': 4,  # Request 4 paragraphs
    's': 6,  # Each paragraph with 6 sentences
    'decorate': 'true' # Include HTML paragraph tags
}
headers = {
    'Authorization': f'Bearer {API_KEY}',
    'Accept': 'text/html' # Or 'text/plain' depending on 'decorate' parameter
}

try:
    response = requests.get(url, params=params, headers=headers)
    response.raise_for_status()  # Raise an HTTPError for bad responses (4xx or 5xx)
    print(response.text)
except requests.exceptions.RequestException as e:
    print(f"An error occurred: {e}")
    if response.status_code == 401:
        print("Check your API key and subscription.")
    elif response.status_code == 403:
        print("Permission denied. Check your plan limits.")

When executing the above examples, ensure that the LORIPSUM_API_KEY environment variable is set in your development environment, or substitute YOUR_API_KEY directly for testing purposes (though not recommended for production). The API will return the generated placeholder text in the format specified by the decorate parameter and Accept header.

Security best practices

Protecting your Loripsum API key is critical to maintaining the security and integrity of your account and preventing unauthorized usage. Adhere to these security best practices:

  • Keep API Keys Confidential: Treat your API key like a password. Never share it publicly, commit it to version control systems (like Git), or embed it directly in client-side code (e.g., JavaScript in a browser).
  • Use Environment Variables: Store API keys as environment variables on your server or in your local development environment. This keeps them out of your codebase and makes it easier to manage different keys for different environments (development, staging, production).
  • Utilize Secret Management Services: For production applications, consider using a dedicated secret management service (e.g., AWS Secrets Manager, Google Cloud Secret Manager, Azure Key Vault, HashiCorp Vault). These services provide secure storage, access control, and rotation capabilities for sensitive credentials.
  • Restrict Access with IP Whitelisting: If Loripsum's API infrastructure provides IP whitelisting capabilities (check their documentation for availability), configure your API key to only accept requests from known, trusted IP addresses. This adds an extra layer of security, preventing unauthorized access even if the key is compromised.
  • Regular Key Rotation: Periodically rotate your API keys. Regenerating a key invalidates the old one, reducing the window of opportunity for a compromised key to be exploited. Establish a rotation schedule that aligns with your organization's security policies.
  • Monitor API Usage: Regularly review your Loripsum API usage logs (if available through your dashboard) for any unusual activity. Spikes in usage or requests from unexpected locations could indicate a compromised key.
  • Enforce HTTPS/TLS: Always ensure that all API requests are made over HTTPS. This encrypts the communication channel between your application and the Loripsum API, preventing eavesdropping and tampering with your API key in transit. Loripsum, like most modern APIs, mandates HTTPS. The W3C's recommendations on web security highlight the importance of TLS for securing data in transit.
  • Implement Least Privilege: While Loripsum's API keys typically grant access to all API functions available to your subscription, if there were more granular scopes, you would assign only the necessary permissions to each key.
  • Error Handling for Authentication Failures: Implement robust error handling in your application to gracefully manage authentication failures (e.g., 401 Unauthorized responses). This can help in diagnosing issues and preventing application crashes without exposing sensitive details.