For direct API access, include a personal API key in the X-API-Key header. The Zapier integration uses OAuth instead: sign in to Insyder, select a workspace, and approve its permissions. You do not need to create or paste an API key in Zapier.
X-API-Key: insyder_live_your_key_hereRequests without valid authentication return 401. Never send a key in a URL or query parameter.
In the Insyder app, open Preferences → API access, then:
- Give the key a descriptive name.
- Select the workspaces it may access.
- Choose a permission preset or individual scopes.
- Choose an expiration date.
- Create the key and copy it immediately.
The full secret is shown once. Insyder does not display it again, and a key never gains access to workspaces added to your account later. You can keep up to 10 active keys and select up to 50 workspaces for each key.
| Scope | Allows |
|---|---|
data:read | Read selected workspace data, analytics, and sanitized connection results |
leads:write | Update status, email, phone, and notes on an existing lead |
products:write | Create, update, and archive products; current OWNER or ADMIN role also required |
purchases:write | Create append-only purchases |
exports:create | Create and cancel exports; data:read is also required |
The Read-only and Full business access presets select common scope combinations. Use Custom when an integration needs fewer permissions.
A key identifies its owner; the API never accepts a user identity from request input. Every request verifies all of the following:
- The key is active and unexpired.
- The requested workspace was explicitly selected for that key.
- The key owner is still a member of the workspace.
- The key has the operation's required scopes.
- The owner's current workspace role permits the operation.
Resources outside the key's authorized workspaces return the same 404 response as resources that do not exist. This prevents tenant information from leaking.
- Store keys in a server-side secret manager or encrypted environment configuration.
- Never commit keys, log request headers, or expose keys in client-side JavaScript or mobile application bundles.
- Use a separate key for each integration and environment.
- Rotate a key immediately if it may have been exposed; the old secret stops working as soon as rotation completes.
- Revoke keys that are no longer used and prefer an expiration date over a non-expiring key.
Scope edits, workspace changes, expiration, rotation, revocation, and membership changes take effect immediately.
Use the same personal key to connect the native MCP to Claude Desktop, ChatGPT, or another assistant. The separate documentation MCP is public and never needs your key.
Next, make your first API request or open the API reference.