Authentication & API keys
Every request carries a bearer token. You mint keys from the API & AI Access page inside your
AutoSync HighLevel menu, and pass them on the Authorization header.
Authorization: Bearer asyk_live_K3jRq...Minting a key
- Open AutoSync inside HighLevel and go to API & AI Access.
- If you see an upsell card instead of a key list, click Enable API Access to turn on the add-on.
- Click + New Key, give it a specific name (e.g.
claude-desktop-laptop,chatgpt-receptionist) — the name shows in the key list and usage chart so you can audit which key does what. - Choose scopes (below), then Create.
- Copy the key now. It starts with
asyk_live_and is shown once — AutoSync stores only a hash and can't recover the plaintext later. Treat it like a password.
Key format is asyk_<env>_<43-char> — env is live today (test is reserved for a future
sandbox). The 12-character prefix (including the live segment) is what shows in the key list.
Scopes
Scopes limit what a key can do. The default * (full access) is fine for your own AI assistant; tighten
scopes when handing a key to a third-party integration.
| Scope | Grants |
|---|---|
services.read | List services, classes, staff, and rooms. |
availability.read | Query available time slots. |
bookings.read | Read individual bookings. |
bookings.write | Create, reschedule, and cancel bookings. |
contacts.read, contacts.write | Contact data (reserved for upcoming contact endpoints). |
* | Full access — the default when no scopes are chosen. |
A call that needs a scope the key doesn't have returns 403 auth.insufficient_scope.
Multi-site (agency) keys
A key is normally tied to one location — no extra header needed. A company-scoped key can serve every
location under an agency; for those, name the target location per request with the
X-AutoSync-Location-Id header (AutoSync verifies it belongs to your company).
Confirm a key works
Hit the ping smoke test — it returns the resolved location, platform, tier, and key info so you can
verify everything end-to-end before integrating:
curl https://autosync.io/api/v1/ping \
-H "Authorization: Bearer asyk_live_PASTE_YOUR_KEY"Keep keys safe
- One key per integration. If your laptop's Claude and your office ChatGPT both use AutoSync, mint two keys — so if one leaks you revoke just that one.
- Never paste a key into a chat message to an AI agent — it belongs in the client's headers config, not the conversation.
- Rotate on staff changes. Revoke old keys from the API & AI Access page; a revoked key stops working immediately.
- Watch the usage chart — unusual spikes or clusters of 4xx errors often mean a misbehaving or compromised key.
Last updated July 2026