The dashboard runs on a REST API, and a scoped API key lets your own scripts call it: read leads, pull stats, manage flows. Bearer-authenticated, permission-scoped, on your own host.
Everything the d0pe dashboard shows, it fetches from a REST API on your own server. An API key opens that same API to your scripts — so anything you can see or do in the UI, you can do in JSON. Pull today's lead count into a spreadsheet, mirror statuses into your own warehouse, spin flows up or down from a deploy script — it's your data on your box, now with a programmatic door.
Settings → API → New key. Give it a name, tick the scopes it needs, and copy the key — it's shown once and never again. If you lose it, revoke it and make another; a revoked key stops working immediately.
Send the key as a Bearer token, exactly like the dashboard sends its session token:
curl https://your-crm-host/api/leads/search?limit=50 \ -H "Authorization: Bearer d0pe_your_key_here"
No key, wrong key, or a revoked one → 401. A key used from an IP your account's allow-list blocks → 403, the same as the UI.
A key acts as the operator who created it and can only ever do LESS. Scopes are the second limit on top of that: they read module:action — leads:view, flows:edit, analytics:view — the same permission vocabulary as roles. A key minted for leads:view is refused any write, and a scope your own role doesn't hold can't be granted in the first place.
Keys reach the resource API — leads, flows, campaigns, analytics, and the rest. Session-only screens (your profile, the hosting and licence panels) stay closed to keys by design: those are for a signed-in human, not a script.
Your instance publishes a live, interactive OpenAPI schema at /api/docs (Swagger UI) and /api/openapi.json — every endpoint, its parameters and response shape, generated from the running server, so it is always exactly what your version does. Open https://your-crm-host/api/docs in a browser to click through and try calls; point your client generator at /api/openapi.json and you have a typed SDK in a minute.
# List your partners, campaigns and traffic sources curl -H "Authorization: Bearer d0pe_…" https://your-crm-host/api/partners curl -H "Authorization: Bearer d0pe_…" https://your-crm-host/api/campaigns curl -H "Authorization: Bearer d0pe_…" https://your-crm-host/api/traffic-providers # Search leads (same filters as the Leads table) — the row carries autologin_url curl -H "Authorization: Bearer d0pe_…" \ "https://your-crm-host/api/leads/search?limit=50&date_type=registration" # One lead in full, including its partner autologin link curl -H "Authorization: Bearer d0pe_…" https://your-crm-host/api/leads/123
The autologin link a partner returned for a lead is the lead's autologin_url — present on each row of /api/leads/search and on the single-lead /api/leads/{id}. Everything else the dashboard shows has an endpoint too; the full list, with every parameter, is the /api/docs page above.
Treat it like a password: it carries your access. Store it in your secret manager, not in a repo. Give each integration its own key so you can revoke one without breaking the others, set an expiry if it's temporary, and check “last used” in the list to spot a key nothing is calling any more.