Authentication and environments

All requests originate from the CRM backend and use Bearer authentication.

curl "https://social-api.example.com/api/v1/wallet/external/account" \
  -H "Authorization: Bearer YOUR_CRM_API_KEY" \
  -H "Accept: application/json"

Connection variables

Variable	Documentation example	Purpose
`API_BASE_URL`	`https://social-api.example.com`	ExuraCopy API origin.
`SOCIAL_CLIENT_BASE_URL`	`https://social.example.com`	Public client targeted by SSO.
`CRM_API_KEY`	`YOUR_CRM_API_KEY`	Secret backend credential.

Portal domains are placeholders. Use only the values provided by ExuraCopy for your environment, and never publish a real credential in documentation or repositories.

Security rules

Store the API key in a secrets manager.
Apply an IP allowlist when available.
Do not include the credential in error messages or logs.
Set timeouts and controlled retries.
Rotate the credential after any exposure.
Use HTTPS in all shared environments.

Webhook secret

The API key authenticates requests sent by the CRM to ExuraCopy. The webhook uses a separate secret to verify events sent by ExuraCopy to the CRM.

Store both secrets separately.
Do not use the API key to calculate signatures.
Preserve the original webhook body until verification is complete.
Rotate the signing secret through POST /api/v1/integrations/crm/account-webhook/rotate-secret and update the receiver immediately.

Previous: Activation with ExuraCopy

Review the activation order.

Next: Synchronize branches

Last modified on November 3, 2026

Getting Started

Integration Flows

Reliability

Connection variables

Security rules

Webhook secret

​Connection variables

​Security rules

​Webhook secret

Previous: Activation with ExuraCopy

Next: Synchronize branches

Connection variables

Security rules

Webhook secret