> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://dev.admoji.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://dev.admoji.com/_mcp/server.

# Authentication

The Admoji Open API uses a workspace-scoped **ApiKey** for authentication. The key must be sent in the `Authorization` header on every request.

## Header format

```
Authorization: ApiKey secret_492796e421a34666a5695d53cd311111
```

Replace `secret_492796e421a34666a5695d53cd311111` with your key. Requests without a valid key return `Status: 1` with an `ErrorMessage` describing the failure.

> **Warning**
>
> Treat the ApiKey like a password. Do not expose it in browser code, mobile apps, or public repositories.

## Where to find your key

1. Sign in to the Admoji CRM.
2. Open **Settings → Account settings → API Keys**.
3. Copy an existing key, or click **Generate new key** to create one.

Each CRM workspace has its own key ring; keys created in one workspace do not authorize requests against another.

## Verify a key

The `test-auth` endpoint returns `Status: 0` if the key is valid and `Status: 1` if it is not. Use it during setup and when rotating keys.

**`Verify`**

```shell title="Verify"
curl -X GET 'https://openapi.responsecrm.com/api/v2/open/test-auth' \
  -H "Authorization: ApiKey secret_492796e421a34666a5695d53cd311111"
```

**`Valid key`**

```json title="Valid key"
{ "Status": 0 }
```

**`Invalid key`**

```json title="Invalid key"
{ "Status": 1, "ErrorMessage": "Unauthorized" }
```

## Rotating keys

1. Generate a new key in the CRM.
2. Deploy the new key to your integration.
3. Confirm traffic on the new key via CRM logs.
4. Revoke the old key from the same **API Keys** screen.

## Related

#### [Idempotency](/idempotency)

Required on every POST request

#### [Get support](https://support.admoji.com/hc/en-us)

Account and key issues