Skip to main content
The REST API is in early access and is enabled per account on request. API keys are not yet issued from the dashboard. To request access, contact your account executive.
Every request to the DeltaLead API is authenticated with an API key sent as a Bearer token in the Authorization header. Requests that omit the header or supply an invalid key are rejected with a 401 Unauthorized response before any processing occurs.
This is the same key model used by the Custom Webhook — one issuance, rotation, and revocation story for the whole platform.

​
Live and Sandbox Modes

The key prefix determines the mode, and nothing else in the request does: there is no header, parameter, or alternate host that changes it. Sending a sandbox key from a production environment is a silent failure as far as the API is concerned: the request is valid and returns 200, but it writes to the wrong place. Inject the key from an environment variable rather than hardcoding it.

​
Managing API Keys

Keys are managed under Organization → Integrations → APIs and Webhooks → Custom Webhooks. The screen — and the API itself — is available on the Growth, Advanced, and Enterprise plans; the Starter plan does not include API access.
1

Open the keys screen

Log in to your DeltaLead account and open Organization → Integrations in the left sidebar. In the catalog, the category is APIs and Webhooks and the item is Custom Webhooks.
2

Choose the mode

The screen splits keys into two sections: Production API keys and Sandbox API keys. Each key is listed with its name, identifier, status, and expiry.
3

Create the key

Creating a key means setting a descriptive name (for example, Production – Zapier) and an expiry: between 1 and 365 days, or no expiry. The full value is displayed only once — copy it immediately and store it securely. A lost key is not recoverable; it is rotated.

​
Statuses

​
Per-Key Actions

  • Rename — changes the display name. It does not affect the key value or in-flight traffic.
  • Rotate — issues a new value for the same entry. This is the operation to use after a leak, or as periodic hygiene.
  • Revoke — permanently invalidates the key. Requests using it start returning 401.
An API key grants full access to your account’s API resources. Never commit it to source code, paste it into chat messages, or store it in plain text. Use environment variables or a dedicated secrets manager (such as AWS Secrets Manager, HashiCorp Vault, or Doppler) to inject it at runtime. If a key is compromised, rotate or revoke it immediately from Organization → Integrations → Custom Webhooks.

​
Sending Your API Key

The key travels in the Authorization header on every request. The examples below show the same GET /leads call in three common environments.

​
Authentication Errors

The API returns the following HTTP status codes for authentication failures: The body shape of these responses is described in the Errors reference.
Keep one key per environment and per integration: a dl_sandbox_ key for automated tests, and one dl_live_ key for each system that consumes the API. That way you can rotate a compromised integration’s key without disrupting the others. A bounded expiry — 90 days, for example — turns rotation into routine rather than incident response.