Skip to main content

Overview

The ElasticFunnels API uses API keys for authentication. Each key belongs to your user account and reaches only the projects (brands) you picked when you created it, as read-only or read and write. It can never do more than your own account can in those projects.
Keep your API keys secure! Never share them publicly or commit them to version control. Treat them like passwords.

Creating an API Key

  1. In your project, go to Settings → API
  2. Click Create API key
  3. Name the key, pick its Projects and its Access (read and write, or read-only)
  4. Click Create API key and confirm it’s you with your passkey, authenticator code or a recovery code
  5. Copy the key from the Copy your new key window. It is shown only once
Creating or regenerating a key needs two-factor authentication on your account and a confirmation in the last 10 minutes. Keys are created from a signed-in browser session only, and an API key can’t create another key. Step-by-step help: Connect the ef CLI and create API keys.

Using Your API Key

Include your API key in the request header using the EF-Access-Key header:
cURL
JavaScript
Python
PHP

Authentication Errors

If authentication fails, you’ll receive one of the following responses:

Invalid API Key

Status Code: 401 Unauthorized

No Brand Access

Status Code: 401 Unauthorized This error occurs when:
  • Your API key is valid but doesn’t have access to the specified brand/project
  • You’re trying to access a project you’re not a member of

Missing API Key

If you don’t include the EF-Access-Key header, you’ll be redirected to the login page (for browser requests) or receive a 404 error (for API requests).

API Key Scope and Permissions

Your API key inherits all permissions from your user account for the specific project.
API keys are:
  • User-specific: Each key is tied to your user account
  • Project-scoped: Each key reaches only the projects you picked (one, several, or all projects you can access)
  • Read-only or read and write: chosen when you create the key
  • Permission-aware: Within those projects, requests never go beyond your own role (Owner, Admin, Editor, etc.)
Scoped keys never reach organization settings, organization billing or team management. An older Full access (legacy) key can do everything your account can do in every project. You can swap it for a scoped key with Convert to scoped key on the API page.

Example Permission Scenarios

Owner/Admin: Access to the project’s content, analytics and settings endpoints Editor: Access to content management endpoints (pages, products, funnels) but not billing or team management Viewer: Read-only access to analytics and content

Best Practices

Rotate Keys Regularly

Regenerate your API keys periodically for enhanced security

Use Environment Variables

Store API keys in environment variables, never in your codebase

One Key Per Integration

Use separate API keys for different integrations to easily revoke access

Monitor Usage

Keep track of which integrations use which keys

Regenerating Your API Key

If your API key is compromised or you need to revoke access:
  1. Go to Settings → API
  2. Click Revoke on the key (it stops working at once), then create a new one. For a legacy full-access key, click Regenerate instead
  3. Confirm it’s you when asked
  4. Update all integrations with the new key
Regenerating an API key immediately invalidates the old key. Any integrations using the old key will stop working until updated.

Testing Your Authentication

You can test your API key with a simple GET request to retrieve your brand details:
A successful response will return your project information with a 200 OK status.