API Authentication

How to authenticate requests to the Boei REST API.

How to get there: Click your profile menu in the top-right → API Keys.

API Keys

Boei uses bearer token authentication. Generate an API key from your account, then send it in the Authorization header of every request:

Authorization: Bearer YOUR_API_KEY

API keys belong to one account. A new key gets a copy of the actions its creator may perform at that moment. Later changes to the creator's role do not change the key's permissions. Transferring account ownership or removing the creator does not move or remove an existing account key. Treat keys like passwords.

Creating a Key

  1. Open API Keys from the profile menu
  2. Click Create new key
  3. Give the key a descriptive name (e.g., "Zapier integration", "Reporting script")
  4. Click Create
  5. Copy the key — this is the only time it is shown in full

The list shows the key name, the first few characters, the creation date, and the last-used date. You cannot retrieve a full key after creation.

Revoking a Key

If a key is exposed or no longer needed, revoke it from the API Keys page. Revoked keys stop working immediately. Any integration using that key needs a new one.

Account Access

Each key works for the account where it was created. An agency key does not automatically give API access to its client accounts. Create a key in the client account for a client integration.

A key with no allowed actions is rejected with 401 and error api_key_has_no_permissions. Create a replacement key with the required access. A valid key that lacks a particular action receives 403 for that action.

Request Example

curl https://app.boei.help/api/v1/contacts \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json"

Rate Limits

Default rate limit is 60 requests per minute per key. Exceeding the limit returns 429 Too Many Requests with a Retry-After header. Contact support if you need a higher limit.

Best Practices

  • Store keys in environment variables, never in code repositories
  • Use a separate key per integration so you can revoke one without breaking others
  • Rotate keys annually
  • Monitor the last-used column for keys you no longer need