Authentication

If you're a developer looking to integrate RabtCRM with your app or website, you need an API key to authenticate every request.

---

Creating an API Key

1. Go to Settings → Developers

2. Click Create New Key
3. Enter a descriptive name (e.g. "Mobile App" or "Website")
4. Click Create
5. Copy the key immediately — it won't be shown again for security reasons

---

API Playground

The Developers page includes a built-in API Playground so you can test requests directly without any external tools:

Tab	What It Does
Send Text	Test sending a text message to a number
Send Media	Test sending an image or file
Send Audio	Test sending a voice note

Each tab shows the Endpoint and a ready-to-copy cURL example.

---

Using the API Key

Add the key as an Authorization header in every HTTP request:

Authorization: Bearer YOUR_API_KEY_HERE
Content-Type: application/json

cURL Example

curl -X GET https://rabtcrm.com/api/v1/contacts \
  -H "Authorization: Bearer YOUR_API_KEY_HERE" \
  -H "Content-Type: application/json"

JavaScript (fetch)

const response = await fetch('https://rabtcrm.com/api/v1/contacts', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY_HERE',
    'Content-Type': 'application/json',
  },
});
const data = await response.json();

Python

import requests

headers = {
    'Authorization': 'Bearer YOUR_API_KEY_HERE',
    'Content-Type': 'application/json',
}

response = requests.get('https://rabtcrm.com/api/v1/contacts', headers=headers)
data = response.json()

---

Scopes

Each key has scopes that decide which endpoints it can call. Pick them when you create the key (Read-only, Full access, or one by one), or change them later with Edit access next to the key. Keys created before scopes existed can only send messages and show as Send only (legacy).

See the full list of scopes and which endpoints each one allows.

---

Response Codes

Code	Meaning
200 OK	Request succeeded
201 Created	New record created successfully
400 Bad Request	Invalid request data
401 Unauthorized	Missing or invalid API key
403 Forbidden	Insufficient permissions
404 Not Found	Resource not found
429 Too Many Requests	Rate limit hit — wait before retrying
500 Server Error	Server-side error — contact support

---

API Key Security

• Never put an API key in client-side JavaScript
• Never commit it to GitHub or any public repository
• If it's ever leaked, delete it immediately and create a new one
• Store keys in environment variables, not in source code

---

Deleting an API Key

1. Go to Settings → Developers
2. Find the key in the list
3. Click the delete icon next to it
4. Confirm deletion

The key is revoked instantly and all requests using it will fail.

---

Next Step

← Sending Messages via API