The lead API key

It prints the whole contract: the endpoint to post to, the header to send, and the shape of the body. Two fields are required, the client's name and their email, and everything else is optional.

123

1. 1The endpoint, the header and the body
2. 2With no key, the endpoint rejects everything
3. 3Generate key

The address in the picture is the workspace these screenshots came from. Yours prints your own.

The key appears once, in a box of its own, with a warning under it: copy this now, it cannot be shown again, and a lost key is regenerated rather than recovered. Only the first few characters are stored, which is what the card shows afterwards.

123

1. 1The prefix, which is all that is kept
2. 2Revoke key, which turns the endpoint off
3. 3Shown once, and stored nowhere

The key itself is hidden in that picture. It is a credential, and one does not belong on a public page.

Send it as Authorization: Bearer and the key. Keep it on your server, not in a page a visitor can read, because anyone holding it can create projects in your workspace.

The endpoint creates a project at Lead stage and returns the client's intake link, so your own thank-you page can hand it straight to them and the form becomes the first step of the intake rather than the end of one.

Regenerate key issues a new one and revokes the old one immediately, which the card says beside the prefix. Anything still posting with the old key stops working the moment you press it, so change your form first.

Revoke key leaves the endpoint rejecting everything, and the card goes back to saying no key is set. This is one endpoint with one key, not an integrations framework, and there is nothing else to unwind.