Skip to main content
Developer API requests use bearer authentication.

​
API key behavior

  • Raw keys are shown once at creation time.
  • FirstSales stores only a hash and a display prefix.
  • Revoked keys stop working immediately.
  • Keys are bound to the creator’s organization membership.
  • If the creator loses access or is suspended, the key fails closed.

​
Access levels

Developer API keys have an access level:
  • workspace: can operate only workspace-scoped resources and requires a workspace target.
  • organization: can operate organization-scoped resources only with explicit organization scopes.
Wildcard scopes do not silently grant dangerous organization-admin powers.

​
Scopes

Use the narrowest scope set possible. Common scopes include:
  • campaigns:read, campaigns:write
  • contacts:read, contacts:write
  • signals:read, signals:write
  • deals:read, deals:write
  • companies:read, companies:write
  • activities:read, activities:write
  • copilot:read, copilot:write
  • inbox:read, inbox:write
  • connectors:read, connectors:write
  • billing:read, billing:write
  • api_keys:read, api_keys:write
  • members:read, members:write
  • groups:write
  • domains:read, domains:write
  • tracking:read, tracking:write
  • suppression:read
  • blocked_domains:read, blocked_domains:write
  • email_auth:read, email_auth:write
  • direct_email:write, direct_email:approve
The wildcard scope * never grants direct_email:approve. Grant it explicitly, and a key without it cannot mint a child key that has it. Signals routes accept signals:read (list signals, leads and analytics) or signals:write (create, edit, run and delete signals; it also covers the read routes). Keys made before these scopes existed keep working: contacts:read still reaches the read routes, contacts:write the write routes, and * reaches both. The Signals scopes grant no contacts routes.

​
CLI auth order

The CLI resolves credentials in this order:
  1. --api-key
  2. FIRSTSALES_API_KEY
  3. Selected local profile
Use environment variables for CI and AI agents.

​
Account login and Connectors

Account login identifies the user. Developer API keys authorize API/CLI automation, and Product MCP uses its own OAuth grant and workspace consent. Sender and third-party Connectors authorize integrations; their tokens are not account-login credentials. Social/email signup and login within the CLI remain pending. See CLI authentication.