Create API Keys for Third-Party Integrations

API keys allow external tools, integrations, and custom-built applications to securely connect to your account and access your data. This article covers how to create and manage two types of API keys: Personal Access Tokens and Service Account Keys, including when to use each and how to stay within API rate limits. For OAuth2 integration setup, see Getting Started with OAuth2.

Personal Access Tokens - Any user of the app can create a Personal Access Token, and it operates under the user context and permissions of the user creating it. Intended for casual/entry level developer users.

Service Access Tokens - Only admins can create a Service Account Key as it will grant admin access to all of the API. Intended for first-party integrations. Third-party integrations should us the OAuth2 Access Code flow. PAT/SAK quotas are not adjustable. Click here for our developer article on PAT/SAK quotas.

How to Create an API Key

1. Click your profile icon and select Settings in the menu.
   
   
2. Scroll down and select API settings from the list
   
   
   If you are a user of Max Classic, click on the profile icon in the top toolbar, and then click on API Settings
   

3. At the top of your screen, select from the following options:

   Third-Party Authorizations - view and manage your previously created API keys

   Personal Access Tokens - Any user of the app can create a personal access token, but it operates under the user context of the user creating it, with that user's visibility and editing permissions. Intended for casual/entry level developers, developers who want to play around with the API, or developers who want a simple authentication experience scoped to a single user and are less concerned about security.

   Service Account Keys - Only admins can create a service account key as it will grant admin access to all of your stored data.  Intended to help you integrate your other business systems with our API.

   

4. Click on New Token if you've selected Personal Access Tokens or New Key if you've selected Service Account Keys
   
   

5. In the window that appears, give the token a descriptive name to distinguish it from other tokens you have created previously or will create in the future. Once you've named your token, click on Create and your unique token will be generated.

   

Your token will appear in the next screen. Click on the Copy button to copy the unique code to your clipboard. Then, paste it somewhere safe. Once you close this window, you will never be able to regenerate this code again. Do not share this token, treat it as a vulnerable secret. In the wrong hands this code can give access to your entire account. Never commit it to source code repositories or deploying it alongside your application code. It is effectively a “password” for your own personal authorization to access data on your behalf.

How to Make API Calls With Your Key

Once you have copied and saved your key, use the following endpoint to make API calls against the full API. Include your key in the request header exactly as shown below.

URI:  https://api.infusionsoft.com
Headers:  "X-Keap-API-Key": "ProvideYourKeyHere"

Replace ProvideYourKeyHere with your actual Personal Access Token or Service Account Key. Treat your key as a password — never commit it to a source code repository or deploy it alongside your application code, as it grants access to your account data on your behalf.

Quotas and Throttles

Both Personal Access Tokens and Service Account Keys are subject to the following rate limits, which cannot be adjusted:

• 10 queries per second
• 240 queries per minute
• 30,000 queries per day

If your integration exceeds any of these limits, API requests will be throttled until the limit resets. Design your integration to stay within these thresholds to avoid unexpected interruptions in service.

FAQ