Admin API Keys

Admin API keys authenticate trusted server-side requests to Encatch. Keep them on your backend and never include them in browser code, mobile apps, or client SDK configuration.

Create an admin API key

1. Open Settings → Admin API Keys.
2. Select New.
3. Enter a key name, optional description, and application identifier.
4. Choose the expiry period.
5. Set the contact creation policy described below.
6. Create the key and copy its value when it is shown.

Contact creation policy

Each Admin API key can control whether a request using that key may create a contact that does not already exist.

• Allow contact creation — The key can create new contacts and update existing contacts.
• Existing contacts only — The key can update contacts that already exist without creating new records.

Use Existing contacts only for integrations that should enrich records already managed by another system. Enable contact creation when Encatch is an intended entry point for new contacts.

The policy is attached to the key, so separate integrations can use different rules. Rotate or replace a key when an integration's responsibility changes.

Security practices

• Store the key in a server-side secret manager.
• Give each integration its own key and descriptive application identifier.
• Use the shortest practical expiry and rotate before it ends.
• Delete a key immediately if it is exposed.

For client-side SDK credentials, use Publishable SDK Keys.