How to Generate and Secure an API Key for Lead Capture

To generate an API key, go to Sales → API Keys → Create key, name it, and set a rate limit. The key is shown to you exactly once immediately after creation — copy it somewhere safe before navigating away, because the CRM never displays the raw key again after that.

When you need this instead of a webhook

The outbound webhooks covered in sending leads to Google Sheets or Zapier push data out of the CRM when something happens. An API key does the opposite: it lets an external system push a new lead into the CRM whenever it wants — a custom website form that isn't a registered landing page, a mobile app, an internal tool, or any system that can make an HTTP request but doesn't fit one of the built-in provider adapters (Google Lead Form Extensions, Meta Lead Ads).

Creating the key

1. Go to Sales → API Keys → Create key.
2. Name — describe what's using it, e.g. "Company website contact form" or "Internal quoting tool" — this matters once you have more than one key and need to know which to revoke if something changes.
3. Rate limit per minute — how many requests this key can make before being throttled. Set it generously above your realistic peak (a form submission spike during a campaign launch, for example) but not so high that a malfunctioning script could flood your pipeline unnoticed.
4. JWT enabled — optional. Turn this on only if your integration specifically needs short-lived signed tokens rather than sending the raw key on every request; for most integrations, the raw key alone is simpler and sufficient.

Save, and copy the key shown immediately — again, this is the only time it's displayed.

Using the key

Send it as a header on every request, either works:

X-API-KEY: your-key-here

or

Authorization: Bearer your-key-here

To create a lead:

POST /api/v1/leads
Content-Type: application/json
X-API-KEY: your-key-here

{
  "name": "John Sharma",
  "phone": "9999999999",
  "email": "john@example.com",
  "tracking": { "gclid": "xxxxxxxxx" },
  "custom_fields": { "budget": "50000", "city": "Delhi" }
}

Only name is required. tracking is optional but worth sending if you have a gclid or UTM data available — it's what makes the lead reportable back to Google Ads or Meta later. Any custom_fields key matching a field you've already created in Custom Fields binds to it directly; anything else is still saved, under "Extra fields" on the lead.

Locking a key down to specific IP addresses

From the key's IP whitelist screen, add the specific IP address(es) that should be allowed to use it. Once at least one IP is whitelisted for a key, requests from any other address are rejected outright, even with a valid key — worth doing for any integration running from a fixed server (your own backend, a known third-party service's documented IP range), and worth skipping for anything running from unpredictable client IPs, like a browser-based form.

If a key is compromised

Revoke it immediately from API Keys — this takes effect right away and also invalidates any JWTs that were issued from it, if JWT mode was enabled. There's no way to rotate a key's secret in place; revoke the old one and create a fresh key for the same integration.