Skip to main content

​
API Key Management

Once you have a key, try signed requests in your browser at the API Sandbox — paste the API key and secret, and the playground signs requests automatically.
API keys let your integrations authenticate with SalesOS using the P2S-SIGN-V1 signed-request scheme. Keys are created and managed exclusively through the SalesOS Dashboard.
API key management requires the admin.integrations capability. Tenant owners and admins have this by default.

​
Create a key

1

Open the Dashboard

Go to dashboard.play2sell.com (or staging) and log in with your admin account.
2

Navigate to API Keys

Go to Integrations > API Keys in the sidebar menu.
3

Create a new key

Click Create API Key and fill in:
  • Name — A descriptive name (e.g., “CRM Nightly Sync”, “Website Forms”)
  • Scope — Tick what the integration will call. For a super-app home screen: checkin:read, missions:read, campaigns:read, progress:read and earnings:read. For the standard integration: default:sync
  • Rate limit — Requests per hour (default: 1,000)
  • Expiration — Optional expiry date
4

Copy both values

After creation, the Dashboard displays two values, only once:
  • API Key — the public identifier, e.g. sk_live_a1b2c3d4.... Sent in the Authorization header on every signed request.
  • API Key Secret — used to compute the request signature. Never sent over the wire.
Copy both immediately and store them securely (environment variables, secrets manager).
The API Key Secret is shown only once at creation time. If you lose it, revoke the key and create a new one — there is no way to recover the secret.

​
Manage existing keys

The same Integrations > API Keys screen lets you:
  • View all active, revoked, and expired keys (the secret is never displayed again)
  • Revoke a key — immediately stops it from working, preserving audit history
  • Delete a key — permanently removes it (prefer revoking)
  • Monitor usage — see request count and last-used date

​
Available scopes

A scope only does something if an endpoint requires it. The Endpoint column says which — a scope no endpoint requires grants nothing today.
The scopes default:sync_collaborators, default:sync_activities, leads:read, leads:write, go:read, payments:read and payments:write appear in the creation list, but no endpoint requires them today. A key created with only those is accepted at creation and gets 403 on every call. If you need leads or payments, talk to us before creating the key.
An empty scope set is not full access — it is access to nothing. The check compares what the endpoint requires against what the key has: a key with no scopes is missing all of them, and gets 403 scope_insufficient on every endpoint that requires one. Always tick the scopes your integration will use.
Composing a super-app home screen? Tick all five at once — checkin:read, missions:read, campaigns:read, progress:read and earnings:read. There is one consumer, and one key is simpler to revoke than five.If you do want to split, the cut that makes sense is giving earnings:read its own key: it is the only one that exposes money.

​
Best practices

Create separate keys for each integration (CRM sync, website forms, partner API). This way, if one key is compromised, you only need to rotate that one.
Keys without expiration live forever. Set an expiry to enforce regular rotation — 90 days is a good default.
Tick only what the integration will use. Leaving it empty does not grant full access — it returns 403 on everything.
Check the request count and last-used date on the Dashboard list. Keys that haven’t been used in months may be candidates for revocation.
  1. Create a new key in the Dashboard
  2. Update your integration to use the new key + secret
  3. Verify the new key works
  4. Revoke the old key

​
Next steps

Authentication

Learn the P2S-SIGN-V1 signing scheme with code samples

Activities Integration

Start sending activities with your new key