How to keep your CRM API keys safe

A CRM API key (or token) is a password that lets software act on your CRM without logging in. To keep it safe: give each key only the permissions it needs, keep it out of website code and emails, store it encrypted in the tool that uses it, rotate it regularly, and revoke it the moment you think it’s been seen.

Least access: pick the smallest scope

Most CRMs now let you choose what a key can do:

• HubSpot private apps: tick only crm.objects.contacts.write (and .read if needed).
• HighLevel Private Integrations: only contacts.write for a lead form.
• Klaviyo private keys: only the Lists, Profiles and Subscriptions access needed.
• Pipedrive and ActiveCampaign keys act as the user who created them. Create them from a user whose access is limited.

A key that can only add contacts can’t download your customer list if it leaks.

Never put keys in website code

If a key is in your website’s HTML or JavaScript, anyone can read it with “View source”. It doesn’t matter that it’s hard to find. Send leads from a server, a form service or an integration that keeps the key on its side.

Also avoid sending keys by email, WhatsApp or in a support chat. If a developer or agency needs one, make a separate key for them and delete it when they’re done.

Store keys properly

Whatever tool holds your key should:

• store it encrypted, not in plain text,
• never show it again after you’ve saved it,
• let you disconnect, deleting the key from its side.

Rotate, and know how to revoke

• Rotate keys every few months, and whenever someone with access leaves. HighLevel, for one, suggests 90 days.
• Rotate without downtime: make the new key, update the tool, check a lead arrives, then delete the old key.
• If a key leaks: delete it in your CRM immediately, make a new one, then check your CRM’s audit or activity log for anything unexpected.

Watch for warning signs

• New contacts you don’t recognise, or a sudden jump in API usage.
• Emails from your CRM about a key found in public code (GitHub scanning catches many).
• Integrations failing with “unauthorised”: a key may have been revoked.

Doing it in RoughFigure

In RoughFigure we’ve built our CRM connections around this. Our connection steps ask for the smallest scopes each CRM offers, keys are encrypted the moment you save them and never shown again, they’re only ever sent to your CRM’s own address, and Disconnect deletes them. If your CRM refuses a key, we stop and show you why rather than retrying it. Connect any of the seven CRMs with a click under Integrations. See every integration.

Questions

Is an API key the same as my password?

No, but it’s as powerful within its scope. Treat it the same way.

Should my web developer have my CRM key?

Give them their own key with limited access, and delete it when the work’s done.

What does “rotate a key” mean?

Replace it with a new one and delete the old one, so a copy you don’t know about stops working.