Authentication
The keys that let your code and your AI assistant act on your account, what each one can reach, and how to replace one.
Your keys
Checking whether you are signed in…
They are also in your dashboard under Integrations → API.
| Key | Who has it | What it can reach |
|---|---|---|
| Master Account API Key | Owners, and teammates with the Master API key permission | Every website on the account, plus account and billing |
| Website API Key | Each website | That one website only |
A website key only reaches its own website. Over the REST API, a request that names another website (its websiteId, or a lead, automation or campaign that belongs to it) is refused with 403. Through the MCP server, a different websiteId is replaced by the key's own website. To read or change another website, use that website's key or the master key.
The same keys work for both ways of connecting:
- REST API: add
privateKey=YOUR_KEYto the request. Every feature page has an API tab with its endpoints, ready to try. - MCP server: your connection URL in Integrations → MCP Server already contains the key (
?token=…). Assistants that support OAuth can sign in with the same URL without the?token=…part instead; they then act as the person who signed in, with that person’s permissions. Every password sign-in allows 10 failed attempts per email and network in 15 minutes; after that it is refused (HTTP 429, Too many failed sign-in attempts. Try again in N minutes.) until the 15 minutes are up.
Whatever the key, the server checks every request against the account’s plan and the person’s permissions. A key never unlocks more than the dashboard would.
Keep keys secret
Anyone with a key, or a connection URL that contains one, can use your account. Keep keys on your server or in your assistant’s settings, never in browser code, shared documents or a public repository.
If a key leaks, rotate it
Open Integrations → API, pick the key and click Rotate Key, then confirm. The new key is shown once in the confirmation; it is also under Show / Copy on the same tab. The master key can also be rotated under Account settings → Advanced. Rotating the master key needs the Master API key permission; a website key needs the Integrations permission on that website.
Rotating takes effect immediately: the old key stops working for the REST API, and any assistant connected with the old connection URL loses access. Copy the new connection URL from Integrations → MCP Server into your assistant, and update any integrations that used the old key.
To disconnect only an assistant that signed in with OAuth, remove our connector in that assistant’s settings.
Website IDs
Most requests take a websiteId: the website the request runs for. Ask your assistant to call list_websites, or copy it from your website’s settings in the dashboard. Website IDs are 24-character strings such as 64b7f0a1c2d3e4f5a6b7c8d9 (a made-up example used throughout these docs).
Find your keys in the dashboard
Every control on this screen
Every button, field and switch, with what it does.
Integrations › API · 6 controlsNeeds: integrations, api keys
| Key type (Master / Website API key) | Drop-down | Master only for Owners and members with the Master API key permission; never in white-label.Options: master, website |
| The selected key (masked) | Shows information | Contains a secret key: never read it out. |
| Show / Hide | Button | |
| Copy | Shows information | |
| Rotate Key | Opens a panel or page | Breaks every integration using the old key. |
| Interactive API documentation | Shows information | Cross-origin iframe: the guide cannot point inside it. |