Create an API key on your CRM or your email tool

Before you click anywhere, here is the picture that makes everything else obvious.

In an office block, a contractor who comes every week is not given your set of keys. They are given a pass. That pass opens the service door and nothing else, it carries a name in the register, and the caretaker can switch it off overnight.

An API key is that pass, in the form of a long code along the lines of xkeysib-8f3a....

• It does not contain your password and cannot be used to work it out.
• It carries a name that you choose, so you know what it is for.
• It is deleted in 1 click, and access stops within the second.

That is why we always prefer a key to a shared password. Lend a password and you no longer know who has it. With a key, you always know.

Take stock of what you use to manage your contacts and your sends.

• A CRM files away your customers and prospects, with their history. For example HubSpot, Zoho, Pipedrive or Axonaut.
• An email tool sends your newsletters and your follow ups. For example Brevo, Mailchimp, Sarbacane or Mailjet.

Sometimes a single tool does both. That is the case with Brevo and HubSpot. Write down its name, that is your starting point.

If you do not know what you have. Look at the bottom of one of your recent newsletters, the name of the tool is almost always there. Or search your emails for an invoice with the word subscription on it.

Sign in to your tool, on a computer ideally, then open its Settings.

Look for a section called API, API keys, Developers or Integrations. It often hides in the advanced settings, or under your account name at the top right.

• If you find it, perfect, move on to the next step.
• If you are going round in circles, do not waste time exploring. Type the name of your tool followed by the words API key into a search engine, the official help page comes up first.

⚠ The labels change, all the time. These tools redesign their settings several times a year. The word API, on the other hand, never moves. Use the search box in the settings and simply type API, it is the most reliable shortcut there is.

If you use one of these tools, you are in the right place in 1 click. Sign in first, then click.

• Brevo, app.brevo.com/settings/keys/api. Otherwise, your name at the top right, then Settings, then SMTP and API, then the API keys tab.
• Mailchimp, admin.mailchimp.com/account/api. Otherwise, your name at the top right, then Account and billing, then the Extras menu, then API keys. You need to be Admin or Manager there, a Standard account cannot create a key.
• HubSpot, Settings, then Integrations, then Private apps. HubSpot withdrew classic API keys in 2022. You create a private app that you call Metabacklinks, and it issues you an access token that plays exactly the same part.
• Sarbacane, account settings, then the API section.
• Zoho and Pipedrive, your personal preferences, then API. The key is often already created there and you only have to copy it.

One reassuring detail with Mailchimp. Their key always ends with a suffix along the lines of -us21. That is not a copying mistake, it is the name of their server. Copy the whole line, suffix included.

Click the Create a key, Generate an API key or New key button, depending on your tool.

• Give it a clear name, for example Metabacklinks. That name is only for you, so you know later what it belongs to. Leave the name empty and in 6 months you will not dare delete anything.
• If the tool asks for permissions, allow reading and writing of contacts and sends. Reading lets us see your lists, writing lets us add a prospect and schedule a campaign. Without writing, all we could do is look.
• Leave aside anything to do with billing or with users, if your tool offers those boxes. We do not need them.
• Confirm. The tool then shows a long code, that is your key.

Copy that code straight away, with the Copy button rather than by hand. Many tools only show it once, and a badly copied key does not work.

If you close the window too quickly, no problem. You create another one, and you delete the one you did not write down.

This key opens your customer file. Treat it like a password.

The right channel. A password manager with sharing, or a single use link that erases itself once it has been read. We provide one if you would like it, you only have to ask.

The channels to avoid. Email, instant messaging and shared documents. Those channels keep a copy that nobody controls any more, often backed up for years. And if a key has already travelled that way, the answer is simple and undramatic, we delete it and create another one in 2 minutes.

What follows is for whoever plugs the tool in, not for you. You can read it out of curiosity, or go straight to the next step.

A key is never written in the code. It lives in an environment file, outside the repository.

# .env, at the root of the project, and NEVER committed.
CRM_API_KEY=sk_live_YourKeyHere

# .gitignore, to check before the first push.
.env
.env.local

And the call, which reads the variable instead of repeating the key.

curl -s https://api.example.com/v1/contacts \
  -H "Authorization: Bearer $CRM_API_KEY" \
  -H "Accept: application/json"

The check that catches a past leak, if the project is tracked by a version control system.

git log -p --all -S "sk_live" | head -40

If the command finds something, the key has travelled and it must be replaced, even if the file has since been deleted. The history keeps it.

Once the key is shared, your agents plug into your tool and get to work. You have nothing more to do.

What you keep, and what will not move.

• The list of your keys stays visible in your settings, with the name of each one and its creation date.
• Many tools also show the date of last use, which tells you at a glance what is still in service.
• Deleting a key cuts access instantly, with no effect on your contacts or on campaigns already sent.

The good habit, once a year. Open that list and delete the keys whose names you no longer recognise. It is the most profitable tidy up there is, and it takes 2 minutes.

And if you change tool one day, just let us know. A new key on the new tool, and everything starts again.