API Keys

Every agency gets a Public API at agency.gary.club/api/public/v1/*. Keys mint from Settings → API Keys in the agency dashboard, OR from inside an individual client''s settings page when you want a client-scoped key.

Where to find it

• Sidebar: Team & Trust → API Keys
• Account tab: emerald CTA card on Settings → Account links to /settings/api-keys
• Per-client: each client''s Settings page has a Client API Keys section for minting agent_live_ keys scoped only to that client

Two key shapes

• gc_live_… — agency-wide. Reads/writes the agency''s own CRM by default. Pass X-Gary-Client-Id per-request to act as one of your clients.
• agent_live_… — bound to one client. Cross-client reads return 404 — no leakage possible. Hand these to integrations that should only see one customer''s data.

Scopes

Mint with the minimum scopes you need:

• crm:read, crm:write
• sms:send, sms:read
• calls:read, calls:initiate
• broadcasts:read, broadcasts:send
• sequences:read, sequences:write
• lists:read, lists:write
• kb:read, kb:write
• ai:invoke — any FUEL-metered AI tool
• webhooks:manage

Letting clients self-serve

By default clients don''t see API Keys in their portal sidebar. To enable:

1. Open the client''s settings → Portal & Team → Portal Visibility.
2. Toggle API Keys on.
3. The client immediately sees an API Keys page in their portal at agents.gary.club/dashboard/api-keys and can mint agent_live_ keys themselves.

Rate limits + rotation

• Default 60 req/min per key, sliding window. Up to 600/min on request.
• Set an expires_in_days on mint when issuing for time-bound integrations.
• Revoke any time from the same UI — propagates within seconds; in-flight requests with that key start returning 401 revoked_api_key.

Full API reference

Complete docs at docs.gary.club/api — endpoint pages for contacts, deals, SMS, calls, KB, MCP, errors, plus the live OpenAPI reference.