Get an API key

Every request needs an X-API-Key header. Keys are scoped to a single CRM panel.

Get your first key

1. Create an account

Registration happens through the website form. Creating the account also creates your CRM panel and mints its first API key, in the same step.

2. Dashboard → API Keys

Your crm_id and key are here, alongside per-key usage and the controls to mint or revoke additional keys.

There is no separate "create a panel" step and no API call to make. A panel is the tenant your key belongs to, and one is provisioned for you at signup — crm_id, primary key, and the user record linking them are all written together.

The rest of this page assumes you are signed in and looking at Dashboard → API Keys.

Primary and secondary keys

A panel has exactly one primary key (named Default) plus any number of secondary keys.

	Primary	Secondary
Read and write panel data	yes	yes
Create a secondary key (`POST /api-keys`)	yes	403
Revoke a secondary key (`DELETE /api-keys/{key_id}`)	yes	403
Can be revoked	no — rotate it instead	yes

Use secondary keys to give each service, environment or teammate its own credential, so you can revoke one without disrupting everything else. Per-key usage is tracked separately.

A new key is shown exactly once

POST /api-keys returns the full key in that response and never again. List endpoints only ever return a prefix. If you lose a secondary key, revoke it and mint a new one.

curl -X POST "$BASE/api/crm/$CRM/api-keys" \
  -H "X-API-Key: $PRIMARY_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "production-worker"}'

Rotate a key

Rotation replaces the key you are calling with. The old key dies immediately and the new one is returned once in the response body.

curl -X POST "$BASE/api/crm/$CRM/rotate-key" \
  -H "X-API-Key: $KEY"

The primary Default key cannot be revoked — rotate it.

Resolve a key to a panel

If you have a key but not its crm_id:

curl "https://api.theonlyapi.com/api/whoami" \
  -H "X-API-Key: $KEY"

This is also how the hosted MCP server turns a bearer token into a tenant.

Check your usage

curl "$BASE/api/crm/$CRM/usage" -H "X-API-Key: $KEY"

Returns plan, api_calls_used, api_calls_limit, accounts_used and accounts_limit. An api_calls_limit of -1 means unlimited. Per-key detail — 30/90-day series, month and all-time totals, endpoint breakdown — is at GET /api-keys/{key_id}/usage.

Keeping keys safe

Send keys in the X-API-Key header only. The API deliberately does not read a key from a query parameter, so keys never land in access logs.
Some keys in circulation are canary tokens. Using a key you found rather than one you were issued raises an alert while still failing as Invalid API key.

Authentication covers what each failure code means.