Distillation

Date: Aug 5, 2026

• 🔴 (17:18) User stated that Loops API keys must never be used client-side or exposed to end users; API keys should be generated in Loops Settings → API, named, separated by purpose, and revocable.
• 🔴 (17:18) User stated that Loops API requests must be issued from a server-side application because the API does not support cross-origin requests from client-side JavaScript.
• 🔴 (17:18) User stated that Loops authentication requires the Authorization: Bearer YOUR_API_KEY header; the API-key value from the documentation is an example and must be replaced with a privately managed key.
• 🔴 (17:18) User stated that Loops contact.created events are emitted only after double-opt-in confirmation when enabled; optInStatus is null or "accepted" and will never be "pending" or "rejected".
• 🟡 (17:18) Loops API documentation describes REST endpoints for managing contacts, sending events, and sending transactional email, with integrations including Zapier, Make, and incoming webhooks.
• 🟡 (17:18) Loops webhook documentation uses webhook-id, webhook-timestamp, and webhook-signature headers; Next.js examples read them from req.headers, and raw-body handling may require bodyParser: false.
• 🟡 (17:18) Loops contact event data includes id, email, nullable firstName and lastName, source, boolean subscribed, userGroup, nullable userId, mailingLists, nullable/accepted optInStatus, and custom contact properties.
• 🟡 (17:18) Loops documentation distinguishes mailing-list unsubscribe events from other contact events and notes that unsubscribe links are not included or required for transactional emails.
• 🟡 (17:18) Loops email-event documentation distinguishes hard bounces as persistent delivery failures, such as nonexistent mailboxes, where delivery will not occur.