The public API — your first request in five minutes
Wire your store or internal system into the platform. One key, one header, an ordinary HTTP request.
Issue a key
Settings → API keys. The key is shown **once**, at creation — we store its hash rather than the key itself, so we cannot show it to you again.
The key grants access to your whole workspace. Put it in an environment variable — not in code that reaches a browser, and not in a public repository.
Authentication
Every request carries the key in an `Authorization` header as a `Bearer` token. No sessions and no cookies.
Response shape
Consistent across every route, so you can write one error handler and be done:
- Success
- `{ "data": ... }` with a 200.
- Failure
- `{ "error": { "code": "...", "message": "..." } }` with an appropriate HTTP status.
- Codes
- `unauthorized`, `forbidden`, `rate_limited`, `bad_request`, `not_found`, `internal`.
Rate limits
120 requests per minute per key. Exceed it and you get a 429 with a `Retry-After` header giving the seconds to wait.
Honour that header rather than retrying immediately — an immediate retry makes the problem worse.
Common patterns
- Online store: each new order → create or update a contact with the right tags.
- Booking system: a day before the appointment → send a Utility reminder template.
- External CRM: sync deals in both directions.
Full reference
The complete list of routes and fields is in the product documentation. If you need an endpoint that is not there, talk to us — most additions start as exactly that request.