Authentication Guide
Download guideAuthenticated CRM requests use HMAC SHA256 signatures with API key, timestamp, nonce and payload hash headers.
Step 1Create or copy an API key from the agent CRM connection.
Step 2Hash the JSON body and build the canonical request string.
Step 3Sign the canonical string with the HMAC secret.
Step 4Use timestamp and nonce replay protection on every signed API request.
| Header | Purpose |
|---|---|
X-CRM-Key | Identifies the CRM connection. |
X-CRM-Timestamp | Unix timestamp used to prevent stale requests. |
X-CRM-Nonce | Unique per request for replay protection. |
X-CRM-Signature | HMAC SHA256 signature. |
METHOD + "\n" + PATH + "\n" + TIMESTAMP + "\n" + NONCE + "\n" + SHA256_HEX(BODY)
PHP
$payloadHash = hash('sha256', $body);
$canonical = "POST\n/api/v1/crm/properties\n$timestamp\n$nonce\n$payloadHash";
$signature = hash_hmac('sha256', $canonical, $secret);Node
const hash = sha256(body);
const canonical = `POST\n/api/v1/crm/properties\n${ts}\n${nonce}\n${hash}`;
const signature = hmacSha256(canonical, secret);Python
payload_hash = hashlib.sha256(body).hexdigest()
canonical = f"POST\n/api/v1/crm/properties\n{ts}\n{nonce}\n{payload_hash}"
signature = hmac.new(secret, canonical.encode(), hashlib.sha256).hexdigest()C#
var payloadHash = Sha256Hex(body);
var canonical = $"POST\n/api/v1/crm/properties\n{ts}\n{nonce}\n{payloadHash}";
var signature = HmacSha256(canonical, secret);Java
String bodyHash = sha256Hex(body);
String canonical = String.join("\n", "POST", "/api/v1/crm/properties", ts, nonce, bodyHash);
String signature = hmacSha256Hex(canonical, secret);cURL
curl -X POST "$BASE_URL/api/v1/crm/properties" \ -H "X-CRM-Key: $CRM_KEY" \ -H "X-CRM-Timestamp: $TS" \ -H "X-CRM-Nonce: $NONCE" \ -H "X-CRM-Signature: $SIGNATURE" \ -d @property.json