Authentication
All API requests require an API key via the X-SalesLobe-Key header. Generate keys in Settings → API Keys.
warning
Keep your API key secret — never expose it client-side or in public repositories. Rotate immediately if compromised.
curl https://<base>/v1/leads \
-H "X-SalesLobe-Key: sl_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json"
Key types
| Prefix | Type | Description |
|---|---|---|
sl_live_xxxxx | Production | Full access within your configured scopes |
sl_partner_xxxxx | Partner | Limited to specific scopes — for white-label integrations |
note
There is no sandbox key. Every key works on your real data and a key with replies.send sends real email. To try the API safely, create a key with only read scopes (leads.read, campaigns.read), or lock it to one test client.
Scopes
| Scope | Grants access to |
|---|---|
suggest | POST /v1/suggest, POST /v1/suggest/feedback |
leads.read | GET /v1/leads, GET /v1/replies/:id |
leads.write | PATCH /v1/leads/:id |
replies.send | POST /v1/replies/:id/send, POST /v1/replies/:id/skip |
replies.approve | GET /v1/replies?status=queued, POST /v1/replies/:id/approve, POST /v1/replies/:id/reject |
campaigns.read | GET /v1/campaigns |
reports.read | GET /v1/reports, GET /v1/reports/:id |
webhooks.manage | POST/GET/DELETE /v1/webhooks |
crm.read | GET /v1/crm/leads, GET /v1/crm/leads/:id (client-scoped keys only, never included in *) |
crm.write | PATCH /v1/crm/leads/:id, POST /v1/crm/leads/:id/notes (client-scoped keys only, never included in *, max 60 writes/min) |
* | All endpoints (default for live keys) |