# Integrate with the Client API

> Connect your own application to EQLEM CRM with an API key. Key scopes, bound-user permissions, IP restriction, rate limits and an OpenAPI documentation UI.

Source: https://www.eqlem.com/en/features/client-api-integration

Connect your own application, website or workflow tool to EQLEM CRM with an **API key**. You create the key yourself in EQLEM under **Integration > Client API keys**; a key can never do more than the EQLEM permissions of the user you bind it to. For an overview see the [CRM module](https://www.eqlem.com/en/modules/crm).

## Who is it for?

Software teams that read or write CRM data from their own systems, web agencies that want form leads to land in CRM, and integration partners. The person who manages keys is an EQLEM user who has the **Client API keys** permission and whose license includes Application Integration.

## How does it work?

### Creating a key

On the **Integration > Client API keys** screen you name the key, choose the **bound user** and set the scope:

- **Read** (`CrmRead`) and **Write** (`CrmWrite`) scopes are granted separately.
- A non-Admin user can bind a key only to themselves and sees only their own keys; an Admin manages all keys.
- Optionally set an expiry date and an IP restriction (a single IP or a CIDR range).
- The full key is shown **only once** at creation; close the window only after you have saved it. If you lose it, rotate the key and take the new one.

### Permissions: bound user and scope together

Every request made with a key runs on behalf of the bound user. What the key can do is **the intersection of the bound user's EQLEM permissions and the key's scope**. A record the user cannot see is not visible through the API either, and a read-only key cannot write.

### Which endpoints are open?

The public API exposes only marked **CRM endpoints**: accounts, contacts, groups, notes, activities, opportunities, stages, territories, calendar, lead import, campaigns, outreach, sequences, inbox, compliance (read), contracts, service requests and analytics. No unmarked endpoint works with a key.

- **Delete, bulk delete, synchronization and webhook endpoints are not in the public API.**
- Contact and account responses do **not** return national ID number, birthday or blood group (KVKK).
- Endpoints that send messages (email, WhatsApp, replies, campaign scheduling) are under a separate, lower rate limit.

### Documentation UI

The available endpoints and their schemas are published as an **OpenAPI** document. On your company's EQLEM API address, `/api/v2/public/docs` shows the interactive documentation UI and `/api/v2/public/openapi.json` gives the machine-readable document.
It lists only public endpoints and contains no tenant data. The key screen also shows a link to the documentation and a sample request.

### Security and operations

- **Header authentication:** the key is sent in the `X-Api-Key` header; a key sent in the URL query string is not accepted.
- **Rate limits:** each key has a general per-minute limit and, for message-sending endpoints, per-minute and per-hour limits, set on the screen; when exceeded the API returns `429` with a wait time.
- **Rotate, deactivate, revoke:** these take effect within a few seconds at most.
- **Audit log:** every keyed request is logged for 90 days with the key, endpoint, status code and IP; request content and the key itself are not written.
- **KVKK:** you are responsible for how personal data fetched with a key is processed; keep the key secret and grant only the scope that is needed.

For an IP restriction to work correctly behind a proxy or load balancer, the platform administrator must make a deployment setting; it is not a setting on the key screen.

## Benefits

No user password is shared for an integration, and a key can be rotated or revoked at any time. Authorization does not add a new model; existing CRM permissions are used. Rate limits, IP restriction and the audit log limit misuse and make it traceable.

## Related modules and products

The Client API opens up the data of the [CRM module](https://www.eqlem.com/en/modules/crm) and of [contact groups](https://www.eqlem.com/en/features/contact-groups). To connect an AI agent instead, see [AI agent connection](https://www.eqlem.com/en/features/ai-agent-connection).
Technical details are in a separate Client API Developer Guide. The feature is delivered as a web screen and an API; there is no key management in the mobile app.

## FAQ

**I lost the key. Can I see it again?** No; the key is shown only at creation and rotation. Rotate it and take the new one.

**How fast does a revoked key stop working?** Rotation, deactivation and revocation take effect within a few seconds at most.

**Can I delete records through the API?** No; delete is not in the public API.

**What license and permission are needed?** Application Integration in the license and the Client API keys permission in EQLEM.

## Next step

Explore the [CRM module](https://www.eqlem.com/en/modules/crm), **Request a technical call** or start with **Try Free**.