Skip to main content

​
API Keys Overview

API keys let your own tools — a spreadsheet script, an automation platform, a custom dashboard — read leads and contacts directly from Cortado. Each key is tied to one organization and is read-only: a key can look up records, but it can never create, change, or delete anything. You manage keys from Settings > Integrations > API Keys.
API access is a beta feature and is turned on per organization. If the API Keys section says access isn’t enabled, email support@cortado.pro to request it.

​
Before You Start

You need two things:
  • API access enabled for your organization (see the note above)
  • The Manage Settings permission on your account — the same permission that lets you edit other organization settings
If you don’t have the permission, the section is visible but the Create API key button is disabled.

​
Creating a Key

1

Open API Keys

Go to Settings > Integrations and open the API Keys section.
2

Click Create API key

A dialog opens asking for a name.
3

Name the key

Give it a name that says where it will be used — Zapier, Website sync, Ops spreadsheet. Names can be up to 100 characters. The name is only a label for you; it has no effect on what the key can do.
4

Copy the key

Cortado shows the full key, which starts with cort_. Copy it and store it somewhere safe right away.
The full key is shown once and never again. Cortado stores only a scrambled fingerprint of it, so nobody — including Cortado support — can look it up later. If you lose a key, revoke it and create a new one.

​
The Keys Table

Every key your organization has ever created appears in the table: Last used is a good health check. A key that says Never days after you set up an integration usually means the tool isn’t sending the key correctly.

​
Revoking a Key

Click Revoke on any active key and confirm. The key stops working immediately, and anything using it starts getting an authentication error on its very next request. Revoking cannot be undone. The row stays in the table marked Revoked so you keep a record of what existed.
Revoke a key whenever someone who had access leaves, whenever a key may have been pasted somewhere public, or whenever you retire the tool that used it.

​
What a Key Can Read

A key can look up two kinds of record in your organization:
  • Leads — pipeline stage, requested event details, tags, the attached contact, and counts of notes, tasks, and quotes
  • Contacts — name, email, phone number, and your custom fields
Keys only ever see your own organization’s data. Asking for a record belonging to another business returns “not found” — the API never confirms that someone else’s record exists. For request formats, field-by-field responses, and examples, see the API Reference.

​
Keeping Keys Safe

  • Treat a key like a password. Anyone holding it can read your leads and contacts.
  • Never put a key in a website, browser extension, or mobile app. Anything running on a customer’s device can be read. Keys belong on a server or inside a tool that stores secrets for you.
  • Don’t email or Slack keys around. Use your password manager or your automation tool’s secrets storage.
  • Use one key per tool. If one needs revoking, the rest keep working.
  • Revoke keys you’re no longer using. An unused active key is only a risk.
  • Check Last used periodically and revoke anything you don’t recognize.

​
Troubleshooting

​
Best Practices

  1. Name keys after the tool that uses them, not after the person who created them — tools outlive team members.
  2. Store keys in a password manager the moment you copy them, before you paste them anywhere else.
  3. Start with one key and add more only when a second tool needs access.
  4. Review the keys table quarterly and revoke anything with a stale Last used date.
  5. Revoke first, ask later — creating a replacement key takes seconds, and a leaked key doesn’t.
  6. Have your tool cache results rather than re-requesting the same lead in a loop, so you stay well under the rate limit.

API Reference

Endpoints, authentication, and response formats

Leads Pipeline

How leads move through your pipeline

Contacts

Managing the people behind your events

Staff & Permissions

Who can manage organization settings