> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cortado.pro/llms.txt
> Use this file to discover all available pages before exploring further.
# API Keys
> Create read-only API keys so your own tools can pull leads and contacts out of Cortado
## API Keys Overview
API keys let your own tools — a spreadsheet script, an automation platform, a custom dashboard — read leads and contacts directly from Cortado. Each key is tied to one organization and is **read-only**: a key can look up records, but it can never create, change, or delete anything.
You manage keys from **Settings > Integrations > API Keys**.
API access is a **beta** feature and is turned on per organization. If the API Keys section says access isn't enabled, email [support@cortado.pro](mailto:support@cortado.pro) to request it.
## Before You Start
You need two things:
* **API access enabled** for your organization (see the note above)
* The **Manage Settings** permission on your account — the same permission that lets you edit other organization settings
If you don't have the permission, the section is visible but the **Create API key** button is disabled.
## Creating a Key
Go to **Settings > Integrations** and open the **API Keys** section.
A dialog opens asking for a name.
Give it a name that says where it will be used — `Zapier`, `Website sync`, `Ops spreadsheet`. Names can be up to 100 characters. The name is only a label for you; it has no effect on what the key can do.
Cortado shows the full key, which starts with `cort_`. Copy it and store it somewhere safe right away.
**The full key is shown once and never again.** Cortado stores only a scrambled fingerprint of it, so nobody — including Cortado support — can look it up later. If you lose a key, revoke it and create a new one.
## The Keys Table
Every key your organization has ever created appears in the table:
| Column | What it shows |
| ------------- | --------------------------------------------------------- |
| **Name** | The label you gave the key |
| **Key** | The first few characters, so you can tell keys apart |
| **Created** | When the key was issued |
| **Last used** | The most recent time the key made a request, or **Never** |
| **Status** | **Active** or **Revoked** |
**Last used** is a good health check. A key that says *Never* days after you set up an integration usually means the tool isn't sending the key correctly.
## Revoking a Key
Click **Revoke** on any active key and confirm. The key stops working immediately, and anything using it starts getting an authentication error on its very next request.
Revoking cannot be undone. The row stays in the table marked **Revoked** so you keep a record of what existed.
Revoke a key whenever someone who had access leaves, whenever a key may have been pasted somewhere public, or whenever you retire the tool that used it.
## What a Key Can Read
A key can look up two kinds of record in your organization:
* **Leads** — pipeline stage, requested event details, tags, the attached contact, and counts of notes, tasks, and quotes
* **Contacts** — name, email, phone number, and your custom fields
Keys only ever see your own organization's data. Asking for a record belonging to another business returns "not found" — the API never confirms that someone else's record exists.
For request formats, field-by-field responses, and examples, see the [API Reference](/api/introduction).
## Keeping Keys Safe
* **Treat a key like a password.** Anyone holding it can read your leads and contacts.
* **Never put a key in a website, browser extension, or mobile app.** Anything running on a customer's device can be read. Keys belong on a server or inside a tool that stores secrets for you.
* **Don't email or Slack keys around.** Use your password manager or your automation tool's secrets storage.
* **Use one key per tool.** If one needs revoking, the rest keep working.
* **Revoke keys you're no longer using.** An unused active key is only a risk.
* **Check Last used periodically** and revoke anything you don't recognize.
## Troubleshooting
| What you see | What it usually means |
| ---------------------------------------------- | ------------------------------------------------------------------------ |
| The API Keys section says access isn't enabled | API access hasn't been turned on for your organization — contact support |
| **Create API key** is greyed out | Your account doesn't have the Manage Settings permission |
| Your tool gets a 401 error | The key is missing, mistyped, or revoked — create a new one |
| Your tool gets a 403 error | API access was turned off for your organization |
| Your tool gets a 429 error | Too many requests too quickly — have the tool wait a minute and retry |
| **Last used** stays **Never** | The tool isn't sending the key as a bearer token |
## Best Practices
1. **Name keys after the tool that uses them**, not after the person who created them — tools outlive team members.
2. **Store keys in a password manager** the moment you copy them, before you paste them anywhere else.
3. **Start with one key** and add more only when a second tool needs access.
4. **Review the keys table quarterly** and revoke anything with a stale **Last used** date.
5. **Revoke first, ask later** — creating a replacement key takes seconds, and a leaked key doesn't.
6. **Have your tool cache results** rather than re-requesting the same lead in a loop, so you stay well under the rate limit.
Endpoints, authentication, and response formats
How leads move through your pipeline
Managing the people behind your events
Who can manage organization settings