Skip to main content
Every request to the DeltaLead API must include a valid API key in the X-API-Key request header. Requests that omit the header or supply an invalid key are rejected with a 401 Unauthorized response before any processing occurs.

​
Getting Your API Key

Follow these steps to generate a new API key from your DeltaLead dashboard:
1

Open Settings

Log in to your DeltaLead account and navigate to Settings in the left sidebar.
2

Go to API Keys

Select the API Keys section. You will see a list of any keys you have already created, along with their creation date and last-used timestamp.
3

Generate a New Key

Click Generate New Key, optionally give the key a descriptive label (for example, Production – Zapier or Staging – testing), and confirm. The full key value is displayed only once — copy it immediately and store it securely.
Your API key grants full access to your DeltaLead account. Never commit it to source code, paste it into chat messages, or store it in plain text. Use environment variables or a dedicated secrets manager (such as AWS Secrets Manager, HashiCorp Vault, or Doppler) to inject the key at runtime. If a key is compromised, revoke it immediately from Settings → API Keys and generate a replacement.

​
Sending Your API Key

Pass your API key in the X-API-Key header on every request. The examples below show the same GET /leads call in three common environments.

​
Key Scopes

Keys created through the dashboard have full access to all API resources associated with your account — leads, conversations, agents, webhooks, and account configuration. Scope-restricted keys (read-only, webhook-only, etc.) are available on the Enterprise plan. Contact your account manager to enable granular key permissions.

​
Authentication Errors

The API returns the following HTTP status codes for authentication failures: A 403 on a specific endpoint typically means the feature is not included in your current plan (Growth, Advanced, or Enterprise). Review the plans page or contact support to upgrade.
Create separate API keys for your development and production environments — for example, Staging – integration tests and Production – live sync. This way you can revoke a compromised staging key without disrupting production traffic. Rotate keys periodically as part of your security hygiene, even if they have not been exposed.