{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-@l10n/en/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Authentication"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"authentication","__idx":0},"children":["Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For direct API access, include a personal API key in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-API-Key"]}," header. The ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/en/guides/zapier"},"children":["Zapier integration"]}," uses OAuth instead: sign in to Insyder, select a workspace, and approve its permissions. You do not need to create or paste an API key in Zapier."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"http","header":{"controls":{"copy":{}}},"source":"X-API-Key: insyder_live_your_key_here\n","lang":"http"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Requests without valid authentication return ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["401"]},". Never send a key in a URL or query parameter."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"create-an-api-key","__idx":1},"children":["Create an API key"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the Insyder app, open ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Preferences → API access"]},", then:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Give the key a descriptive name."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select the workspaces it may access."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Choose a permission preset or individual scopes."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Choose an expiration date."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Create the key and copy it immediately."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The full secret is shown once. Insyder does not display it again, and a key never gains access to workspaces added to your account later. You can keep up to 10 active keys and select up to 50 workspaces for each key."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"scopes","__idx":2},"children":["Scopes"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Scope"},"children":["Scope"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Allows"},"children":["Allows"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["data:read"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read selected workspace data, analytics, and sanitized connection results"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["leads:write"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Update status, email, phone, and notes on an existing lead"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["products:write"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create, update, and archive products; current OWNER or ADMIN role also required"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["purchases:write"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create append-only purchases"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["exports:create"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create and cancel exports; ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["data:read"]}," is also required"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Read-only"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Full business access"]}," presets select common scope combinations. Use ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Custom"]}," when an integration needs fewer permissions."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"workspace-and-role-checks","__idx":3},"children":["Workspace and role checks"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A key identifies its owner; the API never accepts a user identity from request input. Every request verifies all of the following:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The key is active and unexpired."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The requested workspace was explicitly selected for that key."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The key owner is still a member of the workspace."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The key has the operation's required scopes."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The owner's current workspace role permits the operation."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Resources outside the key's authorized workspaces return the same ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["404"]}," response as resources that do not exist. This prevents tenant information from leaking."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"store-and-rotate-keys-safely","__idx":4},"children":["Store and rotate keys safely"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Store keys in a server-side secret manager or encrypted environment configuration."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Never commit keys, log request headers, or expose keys in client-side JavaScript or mobile application bundles."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use a separate key for each integration and environment."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Rotate a key immediately if it may have been exposed; the old secret stops working as soon as rotation completes."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Revoke keys that are no longer used and prefer an expiration date over a non-expiring key."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Scope edits, workspace changes, expiration, rotation, revocation, and membership changes take effect immediately."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the same personal key to ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/en/guides/native-mcp"},"children":["connect the native MCP to Claude Desktop, ChatGPT, or another assistant"]},". The separate ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/en/guides/mcp"},"children":["documentation MCP"]}," is public and never needs your key."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Next, ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/en/guides/quickstart"},"children":["make your first API request"]}," or open the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/en/api/openapi"},"children":["API reference"]},"."]}]},"headings":[{"value":"Authentication","id":"authentication","depth":1},{"value":"Create an API key","id":"create-an-api-key","depth":2},{"value":"Scopes","id":"scopes","depth":2},{"value":"Workspace and role checks","id":"workspace-and-role-checks","depth":2},{"value":"Store and rotate keys safely","id":"store-and-rotate-keys-safely","depth":2}],"frontmatter":{"title":"Authentication","description":"Create and safely use scoped Insyder API keys.","seo":{"title":"Authentication"}},"lastModified":"2026-09-16T07:19:45.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/en/guides/authentication","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}