Authenticate DeltaLead API Requests with a Bearer Key

The REST API is in early access and is enabled per account on request. API keys are not yet issued from the dashboard. To request access, contact your account executive.

Every request to https://platform-api.deltalead.ai/v1 carries a key in the Authorization header. Without it the request is rejected before any processing. There are no cookies, sessions, or OAuth flows for server-to-server access — a valid bearer key is all that is needed. The key also selects the mode. A dl_live_ key writes real leads; a dl_sandbox_ key writes to an isolated store that never reaches the inbox and self-purges. Nothing else in the request changes between them, so the same integration can be verified against sandbox and then promoted by swapping the key.

Getting a key

Open the integrations screen

In the DeltaLead dashboard, go to Organization → Integrations → Custom Webhooks.

Create a key

Choose production or sandbox, give the key a descriptive name — production-crm-sync, dev-testing — and optionally an expiry between 1 and 365 days.

Copy and store it

Copy the key before closing the dialog and store it in a secret manager such as AWS Secrets Manager or HashiCorp Vault.

The key is shown only once, at creation. Only a hash is stored, so a lost key cannot be recovered — it is rotated. Never keep keys in source code, in .env files under version control, or in plain-text documents.

Sending the key

curl https://platform-api.deltalead.ai/v1/leads \
  -H "Authorization: Bearer dl_live_YOUR_KEY"

Replace dl_live_YOUR_KEY with the key copied from the dashboard. The scheme is matched case-insensitively and the token is trimmed. The same request from common HTTP clients:

import httpx

client = httpx.Client(headers={"Authorization": "Bearer dl_live_YOUR_KEY"})
response = client.get("https://platform-api.deltalead.ai/v1/leads")
print(response.json())

const response = await fetch("https://platform-api.deltalead.ai/v1/leads", {
  headers: {
    Authorization: "Bearer dl_live_YOUR_KEY",
  },
});
const data = await response.json();
console.log(data);

$ch = curl_init("https://platform-api.deltalead.ai/v1/leads");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer dl_live_YOUR_KEY"]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
echo $response;

Error responses

Status	Meaning	Common cause
`401 Unauthorized`	The request carried no valid key.	Header missing, key misspelled, revoked, or expired.
`403 Forbidden`	The key is valid but the account cannot perform the action.	The account is suspended.

Every authentication failure returns the same 401 body, so an error never reveals whether a given key exists:

401 Unauthorized

{"status": "error", "detail": "unauthorized"}

403 Forbidden

{"status": "error", "detail": "forbidden"}

Use a separate key per integration and per mode, so revoking one never disrupts the others. Rotate on a schedule: create the new key, update the secret manager, confirm traffic flows, then revoke the old one.

Next steps

With a key in place, see the API Reference for the full set of endpoints, or the Custom Webhook if the goal is pushing leads into DeltaLead — that surface is available today.

Get Started

Core Concepts

Platform

Integrations

Account & Billing

Authenticate DeltaLead API Requests with a Bearer Key

Getting a key

Sending the key

Error responses

Next steps

​Getting a key

​Sending the key

​Error responses

​Next steps

Getting a key

Sending the key

Error responses

Next steps