Access levels and test keys

New in November 2026. Pick the access level when you create the key in Settings → API → New key.

Full access

The default, and what every key created before November 2026 has.

• Works on every REST endpoint and on the MCP server.
• Acts as the key’s user: an organization key acts as the workspace owner, a personal key as its member, with that member’s permissions.

Contacts: create & update only

For a website, a form tool or a partner system that only needs to send you leads.

• Works on one endpoint: POST /v1/contacts.
• Every other endpoint answers 401 unauthorized, and the MCP server refuses it.
• It can write but not read. The contacts endpoint returns the contact id and what happened, never the data of an existing contact. A leaked key can add or update contacts, but cannot list or export your CRM.

Test keys

A test key starts with nxa_test_ and is always a Contacts: create & update only key.

• POST /v1/contacts runs every check a live key runs and returns the same 422 errors.
• It writes nothing: no contact, no tag, no consent record, no automation run.
• It reads no contact, so it cannot tell you whether a contact already exists. (It does read your workspace’s country and custom field list, to validate like a live key.) A valid request always gets 200 with "test": true and "would": "create_or_update":

{
  "test": true,
  "valid": true,
  "would": "create_or_update",
  "normalized": {
    "email": "[email protected]",
    "phone": "+14155550101",
    "full_name": "Dana Levi",
    "source": "Website contact form",
    "tags": ["website"],
    "custom_fields": { "visit_type": "first_visit" },
    "preferred_language": null,
    "attribution": {},
    "consent": null
  },
  "warnings": ["unknown_custom_field:visit_type"]
}

Use one while you build and test the integration, then swap in a live key.

Which key for what

Integration	Key
Website contact or booking form	Organization key, Contacts: create & update only
A partner or agency sending you leads	Organization key, Contacts: create & update only, one per partner
Building or testing a form integration	Test key
Landing page registering webinar attendees	Organization key, Full access
A report or dashboard that reads data	Organization key, Full access
Your own AI client	An MCP server with OAuth, not an API key