Authentication

The API accepts two Bearer-token schemes. For agents, scripts and integrations you want an API key:

curl -H "Authorization: Bearer pcrm_..." \
  https://personalcrm.me/api/v1/contacts

Requests without a valid token get a 401.

Two token types

Almost everyone wants an API key: self-serve, revocable, made for third-party access. The Supabase access token is what the official web and iOS apps send; it is documented here for completeness (and for anyone building a first-party client against their own account). One capability is reserved to it: DELETE /me (deleting the whole account) is rejected for API keys, so a leaked key can never destroy an account.

Managing keys

Keys are managed in Settings → API Keys:

• Create: give the key a name that tells you where it is used (e.g. "Claude Code" or "Import script"). The key is displayed exactly once.
• Delete: revokes the key immediately; anything using it loses access with the next request.

You can have up to 20 keys. Use one key per tool so you can revoke them independently.

Security model

• Keys are random 160-bit secrets (pcrm_ + 40 hex characters). Only a SHA-256 hash is stored, so a lost key cannot be recovered, only replaced.
• Every request is strictly scoped to the key owner's data. IDs belonging to other users behave exactly like non-existent ones (404/400). The API never reveals whether a foreign ID exists.
• Rate limit: 120 requests per minute per key (429 beyond that, with an X-RateLimit-Remaining header on successful requests).

If a key leaks

Delete it in Settings → API Keys. Revocation is immediate. Then create a fresh key and update whatever was using the old one.