API tokens and the REST API

The API is how your own systems read and write CRM data over standard REST. Authentication is a token you create, scope and can revoke — not your password.

Custom objects are first-class, so data unique to your business is as accessible as the built-in records.

Who this is for

Developers and technical integrators.

Before you start

• Permission to manage API tokens.
• Somewhere secure to store the token — it is a credential.
• Basic familiarity with HTTP requests.

Treat a token like a password, because it is one
A token carries the access it was granted. Never commit one to a repository, never paste one into a chat or a ticket, and give a token only the access it actually needs. If one is ever exposed, revoke it and mint a new one rather than hoping — revocation is immediate and cheap.

Use the API

1. Mint a token
   Create it in settings. You are shown the secret once — store it immediately in whatever you use for secrets.
2. Scope it narrowly
   Give it the least access that does the job. A token for a reporting script does not need write access to anything.
3. Authenticate your requests
   Send the token as a bearer credential on each request. Everything is over HTTPS.
4. Read and write records
   Contacts, deals and custom objects are available over REST, so you can pull pipeline data, create records and move deals from your own code.
5. Pair it with webhooks
   The API is for asking; webhooks are for being told. Most integrations want both — react to a webhook, then call the API for detail.
6. Rotate and revoke
   Revoke tokens for systems you have retired and for anyone who has left. An unused live token is pure risk.

What you get

• Programmatic access to your CRM data over standard REST.
• Custom objects available alongside built-in records.
• Credentials you can scope and revoke, separate from anyone's password.
• A basis for integrations the catalogue does not cover.

Frequently asked questions

Do I need a developer to use the API?

Yes, realistically. The API and webhooks are how technical integrators build custom connections. If you are not writing code, look at the integrations catalogue or workflows first.

What happens if a token leaks?

Revoke it and mint a new one. Revocation takes effect immediately, and rotating is far cheaper than the alternative.

Can I access custom objects?

Yes. Custom objects are first-class in the API, so the data unique to your business is as accessible as contacts and deals.

Should I use the API or webhooks?

Both, usually. Webhooks tell you the moment something happens; the API is how you read detail and write changes back.