Authentication
Create a key in Settings, then API & Webhooks, under API keys. Give it a name and one or more scopes, and copy it straight away: the full key is shown only once. Send it as a bearer token in the Authorization header.
There are three scopes, each including the ones below it. Read covers fetching data and is what you want for dashboards and reporting jobs. Write adds creating and updating posts, comments, votes and tags. Admin adds deleting and merging posts and reading internal notes. Revoke a key from the same page when it is no longer needed.
- 1Open Settings, then API & Webhooks.
- 2Under API keys, create a key with a name and the narrowest scope that works.
- 3Copy the key and store it in your server's secret store.
Core resources
Version 1 of the API covers boards, posts, comments, votes, tags, status changes, people and changelog entries. You can create posts and comments, cast and remove votes on behalf of workspace members, add and remove tags, update a post's status and merge posts.
Changelog entries can be read and created as drafts through the API; publishing stays in Looph, so a person always decides when an announcement goes out.
List endpoints use cursor pagination: pass limit (up to 100) and the next_cursor value from the previous page. Posts can be filtered by status, board, source, a search query and an updated-since date, and comments, votes and status changes by post or board.
Webhooks
Add a webhook in Settings, then API & Webhooks, with a name, a URL, the events you want and, optionally, the boards to watch. Events include post.created, post.status_changed, post.vote_added, post.vote_removed, post.tag_added, post.merged, post.assigned, post.vote_threshold_crossed, comment.created and changelog.published. Test fire sends a test.ping event so you can check your endpoint.
Each delivery is signed with HMAC-SHA256 using the webhook's secret. The X-Loop-Signature header carries a timestamp and the signature of the timestamp joined to the body; verify it before acting on a request. Rotate secret issues a new secret, shown once, and the old one stops working immediately.
Failed deliveries are retried up to five attempts in total, with the wait doubling each time, when your endpoint returns a server error, a timeout or a 429. The Recent deliveries list shows each delivery's event, status, HTTP code and number of attempts, and lets you retry a failed one by hand.
Rate limits
Requests are limited per minute for the whole workspace, not per key, and AI agents using the MCP server draw on the same budget. When you go over it, the API answers with 429 and a Retry-After header, along with X-RateLimit headers showing the limit.
There is no bulk import endpoint. To bring in a large number of posts, use the CSV import in the admin Posts inbox rather than looping over post creation.
Plans, keys and what people build
The API, the MCP server and outgoing webhooks are included from Starter up: Starter, Growth and Business. The per-minute request limit rises with the plan. Getting your own data out is not gated: CSV and JSON export work on every plan.
Common builds on these two pieces are a relay that opens an issue in your tracker when a request is planned, a spreadsheet or warehouse job that pulls posts and votes each night, and a notifier that posts status changes into another chat tool. Give a reporting job a read key; a relay that changes posts needs a write key.
AI agents can work with your workspace through the Looph MCP server, which admins manage under Settings, then Agents. A public Zapier listing is coming soon.
Handling webhooks safely
Treat every delivery as untrusted until its signature checks out, and reject anything that fails or carries an old timestamp. Because failed deliveries are retried, the same event can arrive more than once: every payload has an id field for the event, so record the ids you have handled and skip repeats, and a retry never creates a second issue or a duplicate row.
Answer quickly, within ten seconds, and do the slow work afterwards, so the delivery does not time out and trigger a retry. The Recent deliveries list is the first place to look when an integration stops behaving.