Skip to main content
Every request to the v1 API must carry your API key in the X-Api-Key header:
There’s no separate organization or domain header — the organization your request operates on is determined entirely by the key itself.
An API key is a secret. Never put it directly in client-side code (a browser page, a mobile app bundle) — anyone who views the page’s source can read it. Call the API from a server you control, or use a Humdov form link / embed instead if you don’t have a server (e.g. on Squarespace or Wix).

​
Scopes

Each key is granted a specific list of scopes, in the form {resource}.{operation} — for example members.create or form_responses.view. A request fails with missing_scope if the key wasn’t granted the scope that endpoint requires. Not every resource supports every operation. Some are read-only (events.view, services.view, departments.view, forms.view); others support view, create, and sometimes update. Each endpoint’s reference page states exactly which scope it needs.

​
Key lifecycle

  • Expiration — a key can be created with no expiry, or set to expire in 30, 90, or 365 days. An expired key fails every request with key_expired.
  • Revocation — revoking a key from the dashboard is immediate and permanent. A revoked key fails every request with key_revoked. Revoking never deletes the key’s history — it just stops it from authenticating.

​
Common authentication errors

See Errors for the full response shape.