REST API and API keys

Creating an API key

1. Go to API in the sidebar.
2. Press Create key and name it after the system that will use it (e.g. "Zapier", "Website form").
3. Copy the key immediately - only a hashed version is stored and it cannot be shown again.

Keys act with your permissions only - they can never read or write another user's contacts. Revoke a key at any time from the same page; revocation is immediate.

Authenticating

Send the key in the request header:

Authorization: Bearer rico_XXXXXXXXXXXX

Never mix an API key with a browser session, and never expose a key in client-side code.

Main operations

• List contacts - paginated read of your book with filters.
• Create contact - add a single lead (e.g. from a website form).
• Update contact - change status, value, follow-up date.
• Trigger analysis - run AI analysis on a specific contact.

The full request/response reference with copy-paste examples lives on the API page inside the app, which always reflects the current version.

Rate limits

Programmatic requests are rate-limited per key. If you receive HTTP 429, back off exponentially. For high-volume migrations, use batches or order an assisted integration.