Authentication

API v2 uses the same API key authentication as v1. Every request must include a valid key in the x-api-key header.

API keys

Create and manage keys in Settings → Developer in the Heffl app, or at app.heffl.com/settings/developers. Each key is scoped to a team and acts on behalf of the user who created it.

Request header

curl https://api.heffl.com/api/v2/contacts \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json"

Unauthorized requests

Missing or invalid keys return 401:

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "API key required. Include 'x-api-key' header."
  }
}

Rate limiting

API v2 shares the same rate limit as v1: 60 requests per minute per API key. Exceeding the limit returns 429 with RateLimit-* headers.

Permissions

The API key inherits the creating user’s permissions. If the user cannot create, update, or delete contacts in the app, the API will return 403 Forbidden.

Overview

Objects

Reference

Authentication

Authentication

API keys

Request header

Unauthorized requests

Rate limiting

Permissions

​Authentication

​API keys

​Request header

​Unauthorized requests

​Rate limiting

​Permissions

Authentication

API keys

Request header

Unauthorized requests

Rate limiting

Permissions