Skip to main content
The public API authenticates with API keys only. There is no OAuth flow, no username and password, and no session — a key is all a request needs.

​
Create a key

1

Open Settings → API Keys

In the dashboard, go to Settings and open the API Keys tab. You need the API keys permission; account owners have it by default.
2

Create a key with a name

Click Create API Key and give it a name that says what it is for (crm-sync, website-form). Names must be unique within the account.
3

Copy it now

The full key — pk_ followed by 43 characters — is shown once. Copy it into your secret store. Afterwards the dashboard only shows a preview (pk_abcd...).

​
Send it with every request

Put the key in the Authorization header as a Bearer token:
In the Try it panel of any endpoint page, paste the key into the Authorization field; the request is sent through the documentation site’s proxy, so it works from the browser.

​
When authentication fails

Authentication is checked before anything else, so these responses have a plain {"detail"} body rather than the error_code envelope described in Errors:

​
Scope: what a key can reach

A key belongs to the account it was created in and can only read and write that account’s data. If your account is a partner account with several sub-accounts beneath it, a key covers exactly one sub-account — the one you were in when you created it:
  • List endpoints return only that sub-account’s records, including their count.
  • An ID that belongs to a sibling sub-account does not exist as far as your key is concerned: you get a 404 or a UNKNOWN_* refusal, never data from the wrong calendar or pipeline.
To integrate several sub-accounts, create one key inside each and send each sub-account’s requests with its own key.

​
Keep keys safe

A key grants the same access as a user of the account. Treat it like a password.
  • Use keys server-side only. Never embed one in a mobile app, a browser bundle or a public repository.
  • Create one key per integration, named after it, so revoking one does not break another.
  • Revoke a key by deleting it in Settings → API Keys; requests with it fail immediately with 401.
  • To rotate, create the new key, switch your integration over, then delete the old one. There is no expiry — a key stays valid until you delete it.