Authentication and scopes · ConverZAP API

The key acts as you

Each key belongs to one user of the account and acts as that user, never with more access. What it can do is the intersection of:

the scopes chosen for the key;
the user's current role (owner, admin, member or viewer) — if the role changes, the key follows;
the plan modules and the member's access;
during the free trial, read-only.

If the user leaves the account or is deactivated, the key stops working immediately.

Authorization: Bearer czk_live_YOUR_KEY

The api-access-token: czk_live_… header is also accepted (with hyphens; proxies drop headers with underscores). Never put the key in the URL.

Scope	What it allows
`account:read`	Read account, members and plan
`contacts:read`	Read contacts, lists, tags and fields
`contacts:write`	Create and update contacts, lists, tags and fields
`contacts:delete`	Delete contacts
`conversations:read`	Read inbox conversations and messages
`conversations:write`	Assign, resolve, tag and add notes to conversations
`messages:send`	Send WhatsApp messages and templates
`whatsapp:read`	Read numbers, health and templates
`templates:write`	Create and delete templates at Meta
`campaigns:read`	Read campaigns and metrics
`campaigns:write`	Create, start, pause and cancel campaigns
`deals:read`	Read pipelines, stages and deals
`deals:write`	Create, update and move deals
`automations:read`	Read automations
`automations:write`	Enroll and remove contacts from automations
`agents:read`	Read AI agents
`agents:write`	Activate, pause and take over AI agent conversations
`webhooks:manage`	Manage outgoing webhooks
`analytics:read`	Read reports

Members don't get contacts:delete, templates:write or webhooks:manage (owners and admins only). Viewers only get :read scopes.

Store the key in a password vault or environment variable, never in code or in the browser.
Use allowed IPs when your server has a fixed IP.
Grant only the scopes you need and an expiry date.
If it leaks, revoke it in Settings → Public API: it takes effect immediately.