> ## Documentation Index
> Fetch the complete documentation index at: https://docs.automatebusiness.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate CRM requests securely using workspace API keys and scopes.

All requests to the Automate CRM Integration API require authentication via workspace API keys. The key securely associates your request with your CRM organization and enforces granular permissions.

## Authentication headers

Include your API key in the `x-api-key` header with every HTTP request:

```http theme={null}
x-api-key: YOUR_WORKSPACE_API_KEY
Content-Type: application/json
```

> [!NOTE]
>
> Authentication is strictly header-based. Never pass API keys as URL query parameters.

## Required permission scopes

API keys are configured with specific scope capabilities. Ensure that your key has the appropriate scope assigned:

* **`crm:read`**: Required for all read operations, including `GET`, `HEAD`, and `OPTIONS`.
* **`crm:write`**: Required for all state changes and mutations, including `POST`, `PATCH`, `PUT`, and `DELETE`.

If a request is sent with an API key lacking the necessary scope, the server rejects the call with HTTP `403 Forbidden`:

```json theme={null}
{
  "success": false,
  "data": null,
  "error": {
    "message": "Forbidden: insufficient permissions for this operation."
  }
}
```

## Code examples

```bash cURL theme={null}
curl --request GET \
  --url https://crm-api.automatebusiness.com/api/v1/integrations-public/contacts \
  --header 'x-api-key: YOUR_WORKSPACE_API_KEY' \
  --header 'Content-Type: application/json'
```

```javascript Node.js theme={null}
const options = {
  method: 'GET',
  headers: {
    'x-api-key': 'YOUR_WORKSPACE_API_KEY',
    'Content-Type': 'application/json'
  }
};

fetch('https://crm-api.automatebusiness.com/api/v1/integrations-public/contacts', options)
  .then(response => response.json())
  .then(data => console.log(data))
  .catch(err => console.error(err));
```

```python Python theme={null}
import requests

url = "https://crm-api.automatebusiness.com/api/v1/integrations-public/contacts"
headers = {
    "x-api-key": "YOUR_WORKSPACE_API_KEY",
    "Content-Type": "application/json"
}

response = requests.get(url, headers=headers)
print(response.json())
```

## Security recommendations

> [!WARNING]
>
> **Keep your API keys secret.** Never embed API keys directly in client-side code, mobile applications, or public Git repositories. Use server-side proxies or backend microservices to communicate with the CRM API.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.