Authentication

API Keys

All API requests require authentication via API keys. Keys are scoped to your user account and grant access to all workspaces you belong to.

Creating an API Key

Generate API keys from the CRM settings page. Each key has a name for identification and a prefix (sk_...) shown after creation.

Using Your API Key

Include the API key as a Bearer token in the Authorization header:

curl -H "Authorization: Bearer sk_your_api_key" \
  https://api.crmchat.ai/v1/workspaces

Error Responses

If authentication fails, the API returns a 401 Unauthorized response:

{
  "defined": true,
  "code": "UNAUTHORIZED",
  "status": 401,
  "message": "Invalid or missing API key"
}

Rate Limiting

The API enforces a rate limit of 300 requests per minute per user. When exceeded, requests return 429 Too Many Requests.

Security Best Practices

• Never commit API keys to version control
• Use environment variables to store keys
• Rotate keys periodically
• Revoke keys that are no longer needed