Overview
The API Access Credential settings allow you to create user authentication credentials that delegate user access to the APIs and lead receiver for increased security.
API Credentials provide controlled access to:
Account API: Manage user accounts.
Data API: Handle lead data.
Lead Receiver: Allows submission of inbound leads.
Why This Matters
Prevents unauthorized system access
Enables campaign-specific authentication
How to Create Credentials
Navigate to Settings
Go to Settings, then click API Credentials from the left-hand menu
Generate New Credentials
Once in the API Credentials view, click the New button in the top menu
A pop-up window will generate, where you can enter the name for the user credentials in the description field
The system auto-generates a unique Client ID and Client Secret for authenticating API Calls—make sure to save these, as they're hidden after creation and won't be accessible:
Sample:
Client ID (e.g.,
3a8ffe5f-...)Client Secret (e.g.,
258d76a6-...)
Set Scopes
Choose which permissions you want these credentials to have, keep in mind that these allowed scopes can only be sent during creation and are not editable afterwards.
Once done, click Create
Using API Credentials
The Client ID and Client Secret are used in the authentication call to the API, which generates an access token.
The access token will then be used to authenticate the API calls made to the Data API or Account API.
Access tokens are valid for 3600 seconds.
More information on the authentication call can be found in the API documentation: https://api.leadexec.net/#auth_token.
Enabling Campaign Authentication
To enforce authentication for specific campaigns:
Open the Lead Source you want to enforce campaign authentication in
From the Campaigns setting, select the Campaign you want to modify and click Edit
Under the General tab, find the Require Authentication option and enable it
Once done, hit Save
Note: If authentication is required and an invalid access token is passed, the system will not show that lead on the search screen.
Best Practices
Secret Storage: Saving client secrets in password managers is recommended
Scope Planning: Ensure you assign only the required permissions
Troubleshooting
Invalid token errors: verify the Client ID and Client Secret, and check token expiration
Missing leads: confirm the use of a valid token, and ensure the campaign authentication is disabled if not needed