Overview
The ElasticFunnels API uses API keys for authentication. Each key belongs to your user account and reaches only the projects (brands) you picked when you created it, as read-only or read and write. It can never do more than your own account can in those projects.Creating an API Key
- In your project, go to Settings → API
- Click Create API key
- Name the key, pick its Projects and its Access (read and write, or read-only)
- Click Create API key and confirm it’s you with your passkey, authenticator code or a recovery code
- Copy the key from the Copy your new key window. It is shown only once
Creating or regenerating a key needs two-factor authentication on your account and a confirmation in the last 10 minutes. Keys are created from a signed-in browser session only, and an API key can’t create another key. Step-by-step help: Connect the ef CLI and create API keys.
Using Your API Key
Include your API key in the request header using theEF-Access-Key header:
cURL
JavaScript
Python
PHP
Authentication Errors
If authentication fails, you’ll receive one of the following responses:Invalid API Key
401 Unauthorized
No Brand Access
401 Unauthorized
This error occurs when:
- Your API key is valid but doesn’t have access to the specified brand/project
- You’re trying to access a project you’re not a member of
Missing API Key
If you don’t include theEF-Access-Key header, you’ll be redirected to the login page (for browser requests) or receive a 404 error (for API requests).
API Key Scope and Permissions
Your API key inherits all permissions from your user account for the specific project.
- User-specific: Each key is tied to your user account
- Project-scoped: Each key reaches only the projects you picked (one, several, or all projects you can access)
- Read-only or read and write: chosen when you create the key
- Permission-aware: Within those projects, requests never go beyond your own role (Owner, Admin, Editor, etc.)
Example Permission Scenarios
Owner/Admin: Access to the project’s content, analytics and settings endpoints Editor: Access to content management endpoints (pages, products, funnels) but not billing or team management Viewer: Read-only access to analytics and contentBest Practices
Rotate Keys Regularly
Regenerate your API keys periodically for enhanced security
Use Environment Variables
Store API keys in environment variables, never in your codebase
One Key Per Integration
Use separate API keys for different integrations to easily revoke access
Monitor Usage
Keep track of which integrations use which keys
Regenerating Your API Key
If your API key is compromised or you need to revoke access:- Go to Settings → API
- Click Revoke on the key (it stops working at once), then create a new one. For a legacy full-access key, click Regenerate instead
- Confirm it’s you when asked
- Update all integrations with the new key
Testing Your Authentication
You can test your API key with a simple GET request to retrieve your brand details:200 OK status.