Choose a credential with a purpose
API access belongs to the Scale plan. Use a workspace-scoped credential with only the capabilities the integration needs. Keep the secret on your server; never embed it in a public page, browser storage, screenshot or support message.
Read 401 and 403 correctly
401 means the credential is absent, invalid or expired. 403 means the authenticated actor lacks permission for that operation or resource. Refresh or replace credentials through an authorized flow; increasing scopes blindly is not an appropriate fix.
Public requests are different
POST /api/public/leads is the public form endpoint and does not use a private API key. It requires an Idempotency-Key, a supported locale and explicit consent. An access-request receipt does not grant an authenticated API session or workspace membership.