Create an API key
Programmatic access to contacts and lists.
Create keys in Settings → API keys (owners only). A key gives full access to your account’s contacts and lists, so treat it like a password.
Creating one
Name it after where it’s used — “website signup”, “CRM sync” — so you can revoke the right one later without guessing.
The secret is shown once
Copy it before closing the dialog. We store only a hash, so we can’t show it again — the same reason a good service can’t email you your password. Lost it? Create another and revoke the old one.
Using it
Send it as a bearer token:
curl https://www.inboxpenny.com/api/v1/contacts \
-X POST \
-H "Authorization: Bearer YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"email":"sam@acme.com","firstName":"Sam"}'An X-API-Key header works too if that suits your client better. Everything a key touches is scoped to your account — there is no way to reach another customer’s data.
Revoking and deleting
Revoke stops a key working but keeps the row, so you can still see it existed and when it was last used. Delete removes it entirely.
Revoke first if you’re unsure — the last-used timestamp tells you whether anything still depends on it.
What the API covers today
Creating and updating contacts and lists, and managing membership. That covers the usual job: pushing signups and customer records in from your own systems.
Not available yet, so plan around them:
- Reading data back — no list or search endpoints. Export CSV for that.
- Webhooks — nothing calls you when something happens here.
- Bulk endpoints — one contact per request, which matters at volume. See rate limits.
- Sending campaigns — the API is for audience data.
Common issues
401 on every request
Check for a copied trailing space, that the header reads Authorization: Bearer <key>, and that the key isn’t revoked.
I can't find the API keys section
You’re a member, not an owner. Only owners manage keys.
I lost the key
Create a new one and revoke the old. It can’t be recovered.
FAQs
How many keys can I have?+
As many as you want. One per integration is the right habit — it means revoking one thing doesn’t break everything else.
Do keys expire?+
No. They work until revoked, which is why naming them properly matters.
Can I limit a key to one list?+
Not yet — keys carry full access to contacts and lists. Bear that in mind before handing one to a third party.