PeopleTide CRM
Sign inBook a demo
Developers v1
⌘K

API fundamentals

Authenticate with a scoped API key.

Use a dedicated credential per integration, send it in an approved header, and design for expiry, revocation, and rate limits.

Updated 13 September 2026 · 6 min read

Credentials

Send the key in one header.

PeopleTide accepts Authorization: Bearer YOUR_API_KEY or X-API-Key: YOUR_API_KEY. Bearer authentication is preferred because it works consistently across the supported endpoints.

Authentication headers
curl --header 'Authorization: Bearer YOUR_API_KEY' \
  https://api.crm.peopletide.com/api/v1/public/pbx-config

Least privilege

Grant only the capability the sender needs.

  • leads:create — create leads and submit registered server-to-server web forms.
  • calls:create — read PBX configuration and submit Asterisk call events.
  • HMIS connections use their own approved machine authorization and capability grant rather than a general CRM API key.

Traffic

Read the rate-limit headers on every response.

API-key limits are configured per key and enforced over an hourly window. Responses include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. A 429 response also includes Retry-After.

Failure handling

Make errors visible and actionable.

  1. 01

    401 — replace or reactivate the key

    The key is missing, invalid, disabled, expired, or belongs to an inactive workspace.

  2. 02

    403 — correct the permission or request

    The key lacks the required scope or a browser form fails origin or bot verification.

  3. 03

    429 — wait before retrying

    Honor Retry-After and do not fan out retries from multiple workers.

  4. 04

    5xx — retry with a bound

    Use exponential backoff, log the response, and stop after a small number of attempts.