Authentication
API keys, how to send them, and how to keep them safe.
Every request under /v1 needs an API key. Keys are issued in the CRM by an administrator,
shown once at creation, and start with sk_. If a key is lost, revoke it and create another —
the CRM cannot show it again.
Sending the key
Either header works. Authorization is preferred.
curl -H "Authorization: Bearer sk_..." https://api.evacrm.co.uk/v1/whoami
curl -H "x-api-key: sk_..." https://api.evacrm.co.uk/v1/whoamiGET Who am I
/v1/whoamiEchoes the organisation and key the request resolved to, and the timezone in effect for your requests (see dates and timezones). Use it to confirm a new key works, or to check which organisation a key belongs to. No parameters.
curl https://api.evacrm.co.uk/v1/whoami \
-H "Authorization: Bearer sk_..."{
"timezone": "Europe/London",
"organization": { "id": 1, "uuid": "…", "name": "Acme Windows", "timezone": "Europe/London" },
"apiKey": {
"uuid": "…",
"name": "Website form",
"prefix": "sk_",
"lastFour": "aB3x",
"expiresAt": null
}
}Responses
| Case | Status | error |
|---|---|---|
| Valid key | 200 | — |
| No key sent | 401 | Missing API key. Send Authorization: Bearer <key> or x-api-key: <key>. |
| Unknown, malformed or revoked key | 401 | Invalid API key |
| Expired key | 401 | API key has expired |
Unknown, malformed and revoked keys all get the same message on purpose, so nobody can use the API to find out which keys once existed.
A revoked key stops working within a minute of revocation, usually immediately.
Keeping keys safe
- Server-side only. A key grants full access to your organisation's leads. Never put one in a web page, a mobile app, or a repository. The API sends no CORS headers, so a key embedded in browser JavaScript would not work anyway.
- One key per integration. Name them after what uses them. When a vendor relationship ends, revoke that key alone.
- Rotate on staff changes. Anyone who has seen a key can use it until it is revoked.
- Expiry is optional but recommended for trials and contractors.
Permissions
Keys currently carry no scopes: a valid key can use every endpoint on this site. Scoped keys (read-only, leads-only) are planned and will be announced in the changelog; existing keys will keep their current access when they arrive.