API keys and agents
How a script or an AI agent such as Natalee works with this store through the API, what a key can reach, and how to make one.
Last reviewed November 7, 2026
What a key can reach
A key works on one store with the role it was made with. It can do what the app's store pages do: campaigns and their settings, leads, runs, hand-offs, analytics, mailboxes, numbers and webhooks. Inviting people needs a signed-in person, so no key can invite anyone. An admin key can make and delete other keys, so keep admin keys for the few jobs that need them. Natalee and any agent you build work this way.
Making a key
Only an admin or owner can do this. Open API keys in the user menu and press Create new key. Name it after the script or agent that will use it, and make one key for each so you can delete one without breaking the others.
Choose the smallest role that does the job. The key is shown once; keep it in a secret store, and delete it if it leaks.
| Key role | What it can do |
|---|---|
| Viewer | Reads reports, leads and runs, with shoppers' contact details masked |
| Member | Also changes campaigns, leads and runs, and reads those contact details |
| Admin | Also manages mailboxes, numbers and webhooks |
Using it
Send it as a bearer token. The store API at /api/app/stores/{store} covers the app's store pages, and {store} can be the store's slug, its id, or current. The public API under /api/v2 reads leads and campaign runs and can cancel a run.
curl -H "Authorization: Bearer $ACR_API_KEY" \
https://acr.growthdept.ai/api/app/stores/current/analytics/overview?range=last_7_daysEach API allows 300 requests a minute per key, and past that you get a 429 with a Retry-After header. Before a risky change on the store API, add ?dry_run=1 where the route takes it: the change runs and is rolled back, and the answer shows what would have happened.
The API reference lists every operation with code samples. Signed in, the same page is API documentation in the user menu.