Get your API key and format your first authenticated request.
Shape authenticates every request with an API Authorization Key sent in the request header. There are no per-request signatures or token exchanges — send the raw key on each call and you’re set.
Get your API key
Open the API Integrations page in your Shape account and request a key from the Shape Open API integration. If you don’t see that page, ask your system administrator to enable it or share the key.
Treat your API key like a password. Keep it in a secret manager or environment variable, never in client-side code or version control.
Request headers
Send the raw key in the Authorization header. Endpoint URLs are routed and include your {crmid}:
Authorization: {YOUR_API_AUTHORIZATION_KEY}
Content-Type: application/jsonA complete request
A minimal authenticated call, including the routed {crmid} path parameter:
curl --request GET \
--url "https://secure-api.setshape.com/api/get/statuses/YOUR_CRM_ID" \
--header "Authorization: YOUR_API_AUTHORIZATION_KEY" \
--header "Accept: application/json"Authentication errors
| Status | Meaning |
|---|---|
| 404 Not Found | The Authorization header was not supplied. |
| 401 Unauthorized | The key is unknown, is not associated with a company, or the company is not active. |
| 429 Too Many Requests | The account’s Open API allowance has been reached. |