Authentication Overview
An introduction to how authentication works in the ClosingDealz API, including API key usage, workspace scoping, and request authorization.
Table of Contents
The ClosingDealz API uses API key-based authentication to securely identify and authorize requests.
Every API request must include a valid API key. This key determines who you are, which workspace you are accessing, and what actions you are allowed to perform.
How Authentication Works
Authentication is handled via a single HTTP header: Each API key is tied to a specific workspace. All requests made with that key are automatically scoped to that workspace. No session handling or OAuth flow is required, making integrations simple and reliable.
Workspace-Based Access
API keys are workspace-scoped, not user-scoped.
This means:
- All leads created via the API are created inside the workspace linked to the API key
- You cannot access or modify data outside that workspace
- Switching workspaces requires using a different API key
This ensures clear separation between organizations, clients, or projects.
Security Best Practices
To keep your integration secure:
- Store API keys server-side only
- Never expose API keys in client-side code
- Rotate keys if they are ever compromised
- Use different API keys for different environments (production, staging, etc.)
Authentication Errors
If authentication fails, the API will respond with standard HTTP error codes:
- 401 Unauthorized - Missing or invalid API key
- 403 Forbidden - API key does not have access to the requested resource
Ensure the X-API-Key header is included in every request before calling the API.