Skip to main content

​
Overview

The API accepts two kinds of credentials on the same endpoints:
  • Organization API key (et_live_…) — for server-to-server integrations. Acts with Owner scope for your workspace.
  • JWT — the session token used by the app itself (first-party calls).
For integrations, use an API key.

​
Create an API key

Create and manage keys in the app at Settings → API keys — see API keys. The full secret is shown once on creation; store it securely.
An API key has Owner-level access to your workspace. Treat it like a password: never commit it to source control or expose it in client-side code. Rotate it if it may have leaked.

​
Send the key

Pass the key on every request using either header:
A request is treated as an API-key request when the X-API-Key header is present or the bearer token starts with et_.

​
Scope and limits

  • Scope: every key acts as an Owner — there are no granular per-key scopes today. Limit exposure by rotating keys and issuing separate keys per integration.
  • Session-only endpoints: API keys can’t call the Inbox, or manage API keys and webhooks — those require a signed-in user (they return 403).
  • Rate limits apply per workspace — see Conventions.

​
Errors

  • 401 Unauthorized — missing, malformed, revoked, or expired key.
  • 403 Forbidden — key used on a session-only endpoint.
See the full error shape in Conventions.

Conventions

Response envelope, pagination, and rate limits.