API Access

Create API keys so your own systems can work with AIM Automate.

What it does

API access lets your other software (a CRM, a mobile app, an internal tool) work with AIM Automate directly. You create a key, your developer uses it to connect, and your systems can do things like:

• add and update contacts, tags and segments;
• send WhatsApp messages and read your message history;
• use the templates approved for your workspace;
• start a workflow;
• check your credit balance and transaction history, for example to reconcile invoices automatically.

Creating a key

1. Go to Setup → API Documentation and click Manage API Keys.
2. Under Create New Key, give it a clear Key Description, such as "CRM sync" or "Mobile app".
3. Add any restrictions you want (see below).
4. Click Generate Key. The full key is shown once, so copy it straight away and store it somewhere safe.

Restricting a key

Each key can be narrowed down so that, if it ever leaks, the damage is limited:

• Allowed Domains: only your own websites can use the key from a browser.
• Allowed IPs: only your own servers can use it.
• Rate limit: cap how many requests the key can make each minute.
• Expires: the key stops working on a date you choose.
• Read-only: the key can look things up but can't send, import or change anything.

You can change a key's restrictions later from the Active Access Keys list.

Rotating and revoking keys

Open the menu next to a key in Active Access Keys:

• Rotate key creates a new key and shows it once. The old key stops working immediately, so update your systems with the new one.
• Revoke key switches the key off for good. Anything still using it stops working straight away.

Keep your keys secret

An API key works like a password for your workspace.

• Never paste a key into public code, a chat or an email.
• Give each system its own key, so you can revoke one without disrupting the others.
• Rotate a key at once if you think it has been exposed.
• Revoke keys for systems you've retired, and review the list now and then for keys nobody recognises.

For your developer

The full technical reference (how to authenticate, every available action, and example requests and responses) is inside your workspace under Setup → API Documentation. Share access with your developer to get started.

Treat every API key like a password: one per system, restricted where you can, and revoked the day it's no longer needed.