Connect your own application, website or workflow tool to EQLEM CRM with an API key. You create the key yourself in EQLEM under Integration > Client API keys; a key can never do more than the EQLEM permissions of the user you bind it to. For an overview see the CRM module.
Who is it for?
Software teams that read or write CRM data from their own systems, web agencies that want form leads to land in CRM, and integration partners. The person who manages keys is an EQLEM user who has the Client API keys permission and whose license includes Application Integration.
How does it work?
Creating a key
On the Integration > Client API keys screen you name the key, choose the bound user and set the scope:
- Read (
CrmRead) and Write (CrmWrite) scopes are granted separately. - A non-Admin user can bind a key only to themselves and sees only their own keys; an Admin manages all keys.
- Optionally set an expiry date and an IP restriction (a single IP or a CIDR range).
- The full key is shown only once at creation; close the window only after you have saved it. If you lose it, rotate the key and take the new one.
Permissions: bound user and scope together
Every request made with a key runs on behalf of the bound user. What the key can do is the intersection of the bound user's EQLEM permissions and the key's scope. A record the user cannot see is not visible through the API either, and a read-only key cannot write.
Which endpoints are open?
The public API exposes only marked CRM endpoints: accounts, contacts, groups, notes, activities, opportunities, stages, territories, calendar, lead import, campaigns, outreach, sequences, inbox, compliance (read), contracts, service requests and analytics. No unmarked endpoint works with a key.
- Delete, bulk delete, synchronization and webhook endpoints are not in the public API.
- Contact and account responses do not return national ID number, birthday or blood group (KVKK).
- Endpoints that send messages (email, WhatsApp, replies, campaign scheduling) are under a separate, lower rate limit.
Documentation UI
The available endpoints and their schemas are published as an OpenAPI document. On your company's EQLEM API address, /api/v2/public/docs shows the interactive documentation UI and /api/v2/public/openapi.json gives the machine-readable document.
It lists only public endpoints and contains no tenant data. The key screen also shows a link to the documentation and a sample request.
Security and operations
- Header authentication: the key is sent in the
X-Api-Keyheader; a key sent in the URL query string is not accepted. - Rate limits: each key has a general per-minute limit and, for message-sending endpoints, per-minute and per-hour limits, set on the screen; when exceeded the API returns
429with a wait time. - Rotate, deactivate, revoke: these take effect within a few seconds at most.
- Audit log: every keyed request is logged for 90 days with the key, endpoint, status code and IP; request content and the key itself are not written.
- KVKK: you are responsible for how personal data fetched with a key is processed; keep the key secret and grant only the scope that is needed.
For an IP restriction to work correctly behind a proxy or load balancer, the platform administrator must make a deployment setting; it is not a setting on the key screen.
Benefits
No user password is shared for an integration, and a key can be rotated or revoked at any time. Authorization does not add a new model; existing CRM permissions are used. Rate limits, IP restriction and the audit log limit misuse and make it traceable.
Related modules and products
The Client API opens up the data of the CRM module and of contact groups. To connect an AI agent instead, see AI agent connection. Technical details are in a separate Client API Developer Guide. The feature is delivered as a web screen and an API; there is no key management in the mobile app.
FAQ
I lost the key. Can I see it again? No; the key is shown only at creation and rotation. Rotate it and take the new one.
How fast does a revoked key stop working? Rotation, deactivation and revocation take effect within a few seconds at most.
Can I delete records through the API? No; delete is not in the public API.
What license and permission are needed? Application Integration in the license and the Client API keys permission in EQLEM.
Next step
Explore the CRM module, Request a technical call or start with Try Free.