Authentication

All requests to the iClosed.io API must include a valid API key. This page covers how authentication works, how to manage your keys, and how to keep them secure.

Include this header on every request:

Authorization: Bearer iclosed_<your-api-key>

Both Bearer (capitalised, with a space) and the iclosed_ prefix are required. No other authentication method is supported.

1. Log in at app.iclosed.io
2. Go to Settings → Developer → API Keys
3. Click Create API Key, give it a name, and set an optional expiration date
4. Copy the key immediately — it will not be shown again after you leave the page
5. Store it in an environment variable or secrets manager (see Security best practices)

API access requires a Business or Enterprise plan. If you do not see an API Keys section, check your plan at iclosed.io/pricing.

Rotating a key:

1. Create a new key in Settings
2. Update your integration to use the new key
3. Revoke or delete the old key

curl -X GET "https://public.api.iclosed.io/v1/eventCalls?eventType=UPCOMING" \
  -H "Authorization: Bearer iclosed_YOUR_API_KEY" \
  -H "Content-Type: application/json"

const response = await fetch('https://public.api.iclosed.io/v1/contacts', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer iclosed_YOUR_API_KEY',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    firstName: 'Jane',
    lastName: 'Doe',
    email: 'jane@example.com'
  })
});

const { data } = await response.json();
console.log(data.contact.id);

import requests

response = requests.get(
    'https://public.api.iclosed.io/v1/eventCalls',
    params={'eventType': 'UPCOMING', 'limit': 20},
    headers={
        'Authorization': 'Bearer iclosed_YOUR_API_KEY',
        'Content-Type': 'application/json'
    }
)

data = response.json()

1. Open your request → Authorization tab
2. Select Bearer Token from the Type dropdown
3. Paste your full key including the iclosed_ prefix

Example 401 response body:

{
  "message": "API key is required",
  "code": "MISSING_API_KEY"
}

• Never commit keys to version control. Use environment variables, .env files (git-ignored), or a secrets manager.
• One key per environment. Create separate keys for production and development so you can revoke each independently.
• One key per integration. If iClosed connects to multiple tools, give each its own key.
• Set expiration dates. Short-lived keys reduce exposure if a key leaks.
• Rotate after any suspected exposure. Revoke the compromised key immediately and issue a new one.
• HTTPS only. Never send requests over plain HTTP.

To register an OAuth client and implement the authorization code flow, see OAuth Clients.

• OAuth Clients — Register clients, user consent, tokens, and approval
• Rate Limiting — Request limits and backoff strategy
• Errors — Full error code reference
• API Reference — All endpoints