API tokens and the REST API

Owner and Company admin open Company admin → Sales & integrations → Integrations → API and webhooks. Connect your website, ERP or other tools: read and write contacts, leads and deals over a REST API, and get events pushed to your systems.

#Create a token

1. Under API tokens, select New token.
2. Enter a Name, for example the system that will use it.
3. Under Acts as, choose who the changes are made as: - The company: Changes show no person. Keeps working when people leave. - Me: Changes show your name. Stops working if you lose admin rights.
4. Under Permissions, tick what the other system needs, such as Contacts · read or Contacts · write. Write includes read. Give only what the other system needs.
5. Choose when it Expires and select Create token.
6. Copy the token and select I saved it. This is the only time the token is shown. Store it in your other system’s secret settings. Send it as: Authorization: Bearer <token>

Create one token for each system, so you can revoke them separately.

#Use the API

Select API documentation for the endpoints, fields and examples. The API covers contacts, leads, deals and companies: list, read, create and update. It cannot delete records.

• Lists return up to 50 items per page (at most 100 with limit), with a nextCursor for the next page.
• Each token can make 120 requests per minute. Above that, the API answers 429 with a Retry-After header.
• Every change made with a token is recorded in the audit log with the token's name.

#Revoke a token

Select Revoke next to the token. Systems using this token stop working at once. Each token shows when it was last used, so you can spot ones nobody needs any more.