Get started
API keys
Every request (except the docs files) needs an API key in the Authorization header:
Authorization: Bearer mm_live_Ab3x...Keys
- Create keys on the API page of the app. Give each integration its own key ("Clay", "Zapier", "CRM sync"), so you can see its usage and revoke it alone.
- A key is shown once, when you create it. We store only a hash of it, so we cannot show it again. Lost it? Create a new one and revoke the old one.
- Keys belong to your account, not to a person: everyone on your team sees the same keys and can revoke them. The list shows who created each key and when it was last used.
- Revoke works at once: the very next request with that key gets
401 revoked_api_key. - Never put a key in a web page, a mobile app or a public repository. Keep it on a server or in your tool's secret settings.
Live and test keys
mm_live_… | mm_test_… | |
|---|---|---|
| Results | real | made up, realistic, always the same for the same input |
| Credits | charged for emails that work | never charged |
| Contacts mail servers, websites, data sources | yes | never |
| Webhooks | sent | sent (so you can test your endpoint) |
| Data | your account's lists | separate test data, deleted after 30 days |
Test and live data never mix: reading a live job with a test key returns 403 wrong_key_mode. See Test mode for the test values.
Errors
| Status | Code | Meaning |
|---|---|---|
| 401 | missing_api_key | No key in the request. |
| 401 | invalid_api_key | Not a key we know (typo, cut off, deleted account). |
| 401 | revoked_api_key | The key was revoked. |
| 403 | wrong_key_mode | Test key on live data, or the other way round. |
Too many requests with wrong keys from one network (more than 30 a minute) get 429 rate_limited for a minute.