Skip to main content
Every API request needs an API key, sent as a bearer token:
Keys belong to one organization and only ever see that organization’s lanes, leads and usage.

​
Creating a key

Open API and CLI in the dashboard and create a key. The full key is shown once, when you create it. We only store a hash of it, so we can’t show it again. If you lose it, rotate it.

​
Standard and admin keys

Use standard keys for integrations and scheduled jobs. Only owners can create admin keys, and an admin key can only be managed by an owner or another admin key. Admin-only endpoints are marked in the API reference.

​
Rotating and revoking

  • Rotate gives the key a new secret and keeps its name and role. The old secret stops working straight away.
  • Revoke switches a key off for good.
You can do both in the dashboard, or with an admin key through POST /api/v1/keys/{id}/rotate and DELETE /api/v1/keys/{id}.

​
Keeping keys safe

An API key can export leads, and exports use your plan’s contacts. Treat keys like passwords.
  • Keep keys in environment variables or a secrets manager, never in code or URLs.
  • Use a separate key per integration so you can revoke one without breaking the others.
  • Check last_used_at in the dashboard or GET /api/v1/keys to spot keys nobody uses any more.

​
Errors

See Errors for the full list.