Keys
The office owner creates keys in Estalo under Settings › API and webhooks (/dashboard/settings/developers). Creating, replacing or revoking a key requires a session that passed two-step verification if the owner has it enabled.
A key looks like est_live_<12 characters>_<43 characters>. Estalo shows it once, right after you create it, and stores only a SHA-256 hash, so a lost key can't be recovered: replace it. The settings list shows the est_live_<12 characters> part so you can tell keys apart.
Every key has:
- a name, chosen by you;
- one or more scopes. Read:
clients:read,properties:read,deals:read,events:read,leads:read,tasks:read. Write:clients:write,properties:write,deals:write,events:write,leads:write,tasks:write. A write scope does not include reading: a key that creates clients and reads them back needs bothclients:writeandclients:read. Write scopes have extra conditions, see Changing data; - an expiry of 30, 90 or 365 days (there are no keys without an expiry);
- an owner: the person who created it.
A key never reads more than its creator can. Estalo checks, on every request, that the creator is still an active member of the office the key belongs to, that their account is not deactivated, banned or deleted, and that the workspace has an active plan and is not suspended. Owners, managers and directors read the whole office; anyone else reads only records assigned to them. If the creator is later moved to an agent role, the key narrows to that agent's records straight away. If they leave the office, the key stops working.
"Replace" issues a new key with the same name and scopes and revokes the old one in the same step. Revocation takes effect on the next request. An office can have up to 20 active keys.
Send the key as a bearer token. Keys in query strings or other headers are ignored:
curl -s https://estalo.pl/api/v1/me \
-H "Authorization: Bearer est_live_xxxxxxxxxxxx_<your-key>"
/me returns the office id, the key's scopes and expiry, visibility (organization or assigned) and writes: enabled, not_activated (the key has write scopes but the office has not switched changes on), deactivated (the owner switched changes off), key_requires_mfa (the key's creator switched two-step verification off) or no_write_scope.