Skip to Content
REST APIAuthentication

Authentication

Every request carries an organization API key as a Bearer token:

Authorization: Bearer sgtm_live_4f9KxQ2mT7vLp0aZcB3nYw8eRjH6sD1u

A request with no key, or a key that is unknown or revoked, gets a 401 with the code invalid_api_key.

Header
Authorization: Bearer <key>
Key format
sgtm_live_ + 32 characters
Scope
Your whole organization
Who can create
Owners and admins

Create a key

Open Settings → API keys

Sign in to app.syncgtm.com  and open Settings → API keys. Members can see the list; only owners and admins can create or revoke keys.

Name it after where it will live

“CRM sync”, “Signup webhook”, “Data team notebook”. The name is how you will know which key to revoke later, so one key per integration beats one key shared by everything.

Copy the key

The full key is shown once. Sync GTM stores only a hash of it, so it cannot be shown again — if you lose it, revoke it and create a new one. The list keeps the first few characters (for example sgtm_live_4f9K…) so you can tell keys apart.

Use a key

Keep the key out of source code. Read it from an environment variable or your secret manager:

export SYNCGTM_API_KEY="sgtm_live_..."
 
curl https://api.syncgtm.com/v1/api/enrich/verify-email \
  -H "Authorization: Bearer $SYNCGTM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "jane@stripe.com"}'

Call the API from a server, never from a browser or a mobile app. Anyone who can read the key can spend your organization’s credits.

Who a call is billed to

A key belongs to the organization, not to a workspace or a single table. Calls draw on the organization’s credit balance and are recorded against the person who created the key.

A key keeps working only while its creator can still create keys. It stops working — and shows as inactive in the list — when its creator:

  • is removed from the organization, or
  • is changed to a role below admin.

This is deliberate: a key never outlives the authority of the person who made it. If an admin is leaving, have someone who is staying create replacement keys before the change, then swap them into your integrations.

Revoke a key

In Settings → API keys, click revoke on the key. It stops working on the next request. Revoking cannot be undone; create a new key if you need access again.

Revoke a key straight away if it was committed to a repository, pasted into a chat, or logged. Keys use the sgtm_live_ prefix so secret scanners can recognise them.

Never put an API key in a support message. Quote the visible prefix from the key list instead.

Next steps

REST APIEndpoints