Authentication

All RouteMCP API requests are authenticated using API keys. Include your key in the Authorization header as a Bearer token with every request:

curl https://api.routemcp.io/api/v1/crm/contact?provider=hubspot \
  -H "Authorization: Bearer sk_live_your_api_key" \
  -H "X-End-User-Id: user-123"

Getting an API Key

API keys are managed from the RouteMCP dashboard:

Log in to your dashboard at https://app.routemcp.com
Navigate to API Keys
Click Generate New Key
Choose live (production) or test (sandbox) environment
Copy the key — it’s only shown once

Key Types

Prefix	Environment	Description
`sk_live_`	Production	Real data from connected providers
`sk_test_`	Sandbox	Test data, safe for development

Use sk_test_ keys during development and integration testing. Switch to sk_live_ keys for production.

Making Requests

cURL

curl https://api.routemcp.io/api/v1/crm/contact?provider=hubspot \
  -H "Authorization: Bearer sk_live_your_api_key" \
  -H "X-End-User-Id: user-123"

JavaScript (fetch)

const response = await fetch(
  "https://api.routemcp.io/api/v1/crm/contact?provider=hubspot",
  {
    headers: {
      "Authorization": `Bearer ${process.env.ROUTERMCP_API_KEY}`,
      "X-End-User-Id": "user-123",
    },
  }
);

const { data } = await response.json();

Python (requests)

import os
import requests

response = requests.get(
    "https://api.routemcp.io/api/v1/crm/contact",
    params={"provider": "hubspot"},
    headers={
        "Authorization": f"Bearer {os.environ['ROUTERMCP_API_KEY']}",
        "X-End-User-Id": "user-123",
    },
)

data = response.json()["data"]

Security Best Practices

Never expose API keys in client-side code — keep them server-side only
Use environment variables — don’t hardcode keys in source code
Use test keys for development — sk_test_ keys access sandbox data
Rotate keys periodically — generate a new key from the dashboard and revoke the old one
Use separate keys per environment — different keys for staging vs production

Error Responses

Status	Code	Description
`401`	`INVALID_API_KEY`	The API key is missing, malformed, or revoked. Check the `Authorization: Bearer` header.
`429`	`RATE_LIMITED`	Too many requests — see Rate Limits

{
  "success": false,
  "statusCode": 401,
  "message": "Invalid or missing API key",
  "code": "INVALID_API_KEY"
}

Getting Started

Guides

References

Changelog

Getting an API Key

Key Types

Making Requests

cURL

JavaScript (fetch)

Python (requests)

Security Best Practices

Error Responses

​Getting an API Key

​Key Types

​Making Requests

​cURL

​JavaScript (fetch)

​Python (requests)

​Security Best Practices

​Error Responses

Getting an API Key

Key Types

Making Requests

cURL

JavaScript (fetch)

Python (requests)

Security Best Practices

Error Responses