Authentication

The Pixelwand CRM API authenticates external requests using a team API key and API secret. Every API key belongs to a single team, and any record created through the API is associated with that team automatically.

Generating an API key

You generate a key from the team settings in the CRM:

1. Go to your team workspace.
2. Open the API Keys tab — it appears under API Integration and is visible to team owners and admins.
3. Click Generate Key.
4. Optionally add a description (e.g. "Website Contact Form").
5. Click Generate.

The API key is the document identifier (for example abcd1234...) and remains visible in the list as Api Key: <id> — you can copy it at any time. The API secret is shown as team_... and is one-time: it appears as team_XXXXXXXX followed by ******** (api_secret_masked) after the first copy, and the Copy button is then disabled and shows Copied. The list also shows Generated and a Not Copied / Copied badge.

Permissions: Only team owners and admins can generate or delete API keys. Any team member with read access can view and, once, copy the secret.

Treat the API secret like a password. Never expose it in client-side code or commit it to a public repository. If a secret is leaked, delete the key (trash icon in the API Keys list) — this immediately invalidates it — and generate a new one.

Authorizing a request

Send the key and secret with every request using these headers:

No session or cookie is required — the endpoint is allow_guest and validates only these headers.

Example

curl -X POST https://crm.pixelwand.io/api/method/crm.api.leads.create_lead \
  -H "X-API-Key: your_api_key" \
  -H "X-API-Secret: your_api_secret" \
  -d "name=Ada Lovelace"

If the key or secret is missing or invalid, no record is created. The API returns:

{
  "success": false,
  "error": "API key required",
  "message": "Authentication failed"
}

Other messages include Team ID required (missing key) and Invalid API key (mismatch or not found), all with HTTP PermissionError semantics. The secret is verified by decrypting the stored Password field and comparing equality for that key's team.