Skip to main content

Authentication

Every Lead API request must include a valid, active lead key. There are two ways to pass it:

MethodUse
X-API-Key headerREST requests and the JavaScript SDK
_key field in the bodyHTML forms, where no header can be set

If the header is present, the _key field is ignored.

POST /api/public/leads HTTP/1.1
Host: app.advision360.de
Content-Type: application/json
X-API-Key: YOUR_API_KEY

Managing lead keys​

Lead keys are created, deactivated and deleted in Advision360 under Settings → Lead & form keys. Each key belongs to a company and a user: leads sent with the key land on that company's lead board.

A deactivated or deleted key is rejected immediately with 401 Unauthorized.

Can the key be used in the browser?​

Yes. A lead key (pk_live_…) is meant to be used on websites and can only create leads. It gives no access to existing data. That is why it is visible in the page source with the JavaScript SDK and the HTML form.

:::warning Limit misuse

  • Use a separate key per website or campaign. That way you can deactivate a misused key without stopping other forms.
  • Each key allows 100 requests per hour, after that the API responds with 429 (see Rate limit).
  • Only add the domains you actually use as redirect targets (see Redirect).

:::

To read contacts and other company data, use the Public API v1 with its own secret keys (sk_live_…). Those must never be used in the browser.