Authentication

Request headers

Send X-Api-Key on every business request under /api/open/crm/v1/. A CRM JWT does not replace this key. Send Accept: application/json and, for JSON bodies, Content-Type: application/json. File operations use the multipart or signed upload flow documented by their operation.

The optional X-Locale header accepts ru, en, ar, be, de, fr, hy, kk, ky, ro, tg and uz. Missing or unsupported values fall back to ru. Do not parse translated message text as a stable error code.

Profile boundary

The key determines the profile and its owner. Supplying a different profileID, addressID or templateID does not select another profile. Some operations reject these fields and others ignore them; follow the individual request schema. Permissions and referenced IDs are checked within the key's profile.

Key lifecycle

Only the profile owner manages integration keys through the authenticated CRM key-management API. This management API is separate from the public business reference and requires the owner's CRM authentication.

The owner chooses the key name, explicit scopes and an optional expiry in the future. The raw key is shown once when it is issued; listing keys returns metadata, not the original value. The default limit is 20 non-revoked keys per profile; expired keys count toward that limit until revoked.

Revocation immediately prevents further authentication. To rotate, ask the owner to issue a replacement with the required scopes, update your integration, verify its read access and revoke the previous key. Existing keys do not gain newly introduced scopes automatically.

Browser and server integrations

Swagger UI sends your key directly to the selected API server. This static portal has no account or credential storage. Do not place keys in URLs, screenshots, source code or support tickets. For a deployed integration, store secrets on your server. A key embedded in a public browser application is visible to its users.

Browser calls also require the API to allow your application's origin and headers through CORS. CORS does not grant API permissions or replace the key.