For developers
API keys and webhooks
Creating a key, scopes, verifying the signature.
Updated
An API key
- 1Settings → API → New key. Choose a scope: read or write.
- 2The raw key is shown once; only its SHA-256 is kept. If it is lost, revoke it and make a new one.
- 3Send it as Authorization: Bearer mck_…. 120 requests a minute; above that a 429 with Retry-After.
The key belongs to the organisation rather than a person, so per-user record scope does not apply to it. The MCP endpoint accepts the same key.
Webhooks
Events: contact.created, contact.updated, deal.created, deal.status_changed, deal.won, deal.lost, quote.accepted, quote.rejected, invoice.paid, form.submitted, task.completed, webshop.order, record.created, record.updated, company.created, company.updated, deal.updated, task.created, quote.created, product.created, product.updated, invoice.issued, lead.received, call.ended, call.missed.
Every request carries X-MiniCRM-Signature: t=<unix>,v1=<hmac>; the HMAC-SHA256 is over <timestamp>.<body> with the webhook's secret. Check the timestamp too: a request older than five minutes is a replay. A failed delivery retries with exponential backoff, and the log shows the response.
The Slack, Discord, Teams, Zapier, Make and n8n add-ons travel the same path, with a vendor-shaped body.