> ## Documentation Index
> Fetch the complete documentation index at: https://crm-social.exuratech.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and environments

> Protect the API key and prepare the URLs for each environment.

All requests originate from the CRM backend and use Bearer authentication.

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl "https://social-api.example.com/api/v1/wallet/external/account" \
  -H "Authorization: Bearer YOUR_CRM_API_KEY" \
  -H "Accept: application/json"
```

## Connection variables

| Variable | Documentation example | Purpose |
| - | - | - |
| `API_BASE_URL` | `https://social-api.example.com` | ExuraCopy API origin. |
| `SOCIAL_CLIENT_BASE_URL` | `https://social.example.com` | Public client targeted by SSO. |
| `CRM_API_KEY` | `YOUR_CRM_API_KEY` | Secret backend credential. |

> [!WARNING]
>
> Portal domains are placeholders. Use only the values provided by ExuraCopy for your environment, and never publish a real credential in documentation or repositories.

## Security rules

* Store the API key in a secrets manager.
* Apply an IP allowlist when available.
* Do not include the credential in error messages or logs.
* Set timeouts and controlled retries.
* Rotate the credential after any exposure.
* Use HTTPS in all shared environments.

## Webhook secret

The API key authenticates requests sent by the CRM to ExuraCopy. The webhook uses a separate secret to verify events sent by ExuraCopy to the CRM.

* Store both secrets separately.
* Do not use the API key to calculate signatures.
* Preserve the original webhook body until verification is complete.
* Rotate the signing secret through `POST /api/v1/integrations/crm/account-webhook/rotate-secret` and update the receiver immediately.

> [card] [Previous: Activation with ExuraCopy](https://crm-social.exuratech.com/getting-started/activation.md)
>
> Review the activation order.

> [card] [Next: Synchronize branches](https://crm-social.exuratech.com/guides/branches.md)
>
> Register the CRM's external identifiers.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.