API

Authentication and scopes

Create agency API keys, send them correctly, and keep read and write separate.

Creating a key

1
Open API settings
Agency → Automations → API. Only Agency Admins can manage keys.
2
Create a key
Give it a name that says where it will be used, for example "reporting-warehouse".
3
Choose scopes
read for GET, write for POST, or both. Keys have no access by default.
4
Copy it once
The full key is shown only at creation. Afterwards you see the prefix, last-used time and expiry.

Sending the key

bash

curl -s "$AGENTIX_API_BASE?resource=clients" \
  -H "Authorization: Bearer $AGENTIX_API_KEY"

Response

{
  "resource": "clients",
  "data": [
    { "id": "uuid-123", "name": "Acme Plumbing", "status": "active" }
  ],
  "pagination": { "total": 1, "limit": 100, "offset": 0, "has_more": false }
}

Scopes

Scope	Allows	Denied response
`read`	All GET requests	403 on POST
`write`	All POST actions	403 on GET
`*`	Both	-
none	Nothing	403 on every request

Use read-only keys for anything that only reads

A dashboard, warehouse sync or reporting job never needs write. A leaked read key cannot publish content or spend credits.

Key hygiene

One key per integration, so you can revoke one without breaking the others.
Set an expiry on keys given to contractors or short-lived projects.
Keys are stored hashed, a lost key must be replaced, not recovered.
Keys are agency-scoped: they can only reach clients linked to your agency, and every request re-checks that link.
Never put a key in browser code. Call the API from your server.