Authentication
Every request carries a workspace API key.
Send the key
Send your API key in the Authorization header, as a bearer token, on every request:
Authorization: Bearer swt_…A key is swt_ followed by 64 letters. The API does not accept a key in the query string or the body.
What a key can do
A key belongs to one workspace and acts as the member who created it. Leads it creates are created by that member, and it reaches only that workspace's data. A key stops working when it expires, when it is deleted in Settings → Developers → API keys, or when the member who created it leaves the workspace.
Keep it secret
Anyone with the key can act in your workspace. Keep it on your server, in an environment variable or a secret manager, and never in code that runs in a browser or a mobile app. If a key leaks, delete it and create a new one.
Give each system its own key. You can then delete the key of one without touching the others, and each has its own rate limit.
When a key is refused
A missing, unknown, expired or deleted key is answered with 401 and the code api_key.invalid:
{
"error": {
"code": "api_key.invalid",
"message": "Invalid or expired API key",
"requestId": "0b9f6d0e-7c1a-4f4e-9f0a-1d2c3b4a5e6f"
}
}The response does not say which of these it was. Check the key is copied whole and still listed in Settings → Developers → API keys.