Authentication

Requests are authenticated with an API key that belongs to your organization. Every lead sent with a key goes to that organization.

Create a key

Owners and admins create keys in Settings → Integrations. Give each tool its own key (e.g. Zapier, Website) so you can revoke one without affecting the others.

The key is shown only once, when it’s created. Store it in the integration right away; if you lose it, create a new one and revoke the old one.

Send the key

Send the key in the x-api-key header of every request:

POST /api/leads/intake
x-api-key: <your key>
Content-Type: application/json

A missing, invalid or revoked key returns 401 Unauthorized.

Keep the key on a server

Anyone with the key can create leads in your CRM. Don’t put it in a website’s front-end code, where visitors can read it. Send the form to your own backend, or to a tool like Zapier, and call the API from there.

Rate limits

Each key can make 300 requests per minute. Above that, the API returns 429 Too Many Requests; wait a minute and retry. If you need more, use one key per tool.

Revoke a key

Revoke a key from Settings → Integrations. Integrations using it stop sending leads right away.