API keys

Every Intake API request carries a secret key you create in the partner portal. The key is what credits the application to your firm; nothing in the request body decides that.

Authorization: Bearer sk_live_KZIHWuzWvt0xr9FvZ2cemC4Zp1kfMTn4

Create a key

1. Sign in to the partner portal and open Integrations.
2. Under Secret keys, choose Test to build against, or Live for real applications. Name the key after the system that will use it.
3. Copy the key immediately. It is shown once and cannot be retrieved later. If you lose it, revoke it and create another.

A key is 40 characters: an 8-character prefix naming its environment, then 32 random letters and digits. Match on the prefix if you validate keys on your side: sk_live_ for live, sk_test_ for test.

Your public partner ID (cp_live_…) is a different value used by the widget. It is not a secret, and the Intake API refuses it.

Test keys

A sk_test_ key takes exactly the same requests as a live key, with three differences:

• The customer is never contacted. No review link is texted or emailed, and the response reports reviewLink.reason: "test_mode".
• The application is marked as a test. It does not count as a lead, does not appear in your reporting and never earns commission.
• You can use made-up names, phone numbers and email addresses safely.

Build and verify your integration with a test key, then switch to a live key and change nothing else.

Keep keys safe

• A key belongs on your server. Anyone holding it can submit applications as your firm, so it must never appear in browser JavaScript, a mobile app, a public repository or a support ticket.
• Refer to a key by the short prefix shown in the portal, such as sk_live_a1B2. Never paste the whole key.
• Store it with your other server secrets, not in source control.

Rotate a key

Keys do not expire. To replace one without downtime:

1. Create the new key.
2. Deploy it to your systems.
3. Confirm the new key is in use: the portal shows a Last used date for each key.
4. Revoke the old key.

You can hold up to 5 active keys at once, which is what makes that overlap possible, and create up to 10 keys an hour.

Revoke a key

Revoke a key immediately if it may have been exposed. Revocation takes effect within a minute; any system still using that key then receives 401. Revoking one key does not affect your others.

Authentication errors

Status	Message	What to do
401	Missing Authorization header. Expected: Bearer <your API key>	Send the header exactly as Authorization: Bearer <key>.
401	Unauthorized	The key is not valid. Check for a truncated or mistyped value.
401	This API key has been revoked…	Create a new key in the portal.
403	This API key is not permitted to submit applications.	Create a new key.
403	This account is not active…	Contact Credify support.

Don’t retry 401 or 403 with the same key; fix the credential first. After 20 refused attempts in a minute from one IP address, further refused attempts receive 429 instead, until the minute is up.