Authentication

The API authenticates with org-scoped bearer tokens. Every request operates inside the token's organization only — a token can never reach another org's data.

Create a token

In the dashboard, go to Settings → Integrations → Webhook (admin only). Create a token — it's shown once, so copy it immediately and store it as a secret. Reply First keeps only a hash; it can't show you the value again.

Tokens look like:

rf_org_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Send it

Pass the token in the Authorization header on every request:

curl https://replyfirst.ae/api/v1/leads \
  -H "Authorization: Bearer $RF_ORG_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "phone": "+971501234567" }'

await fetch("https://replyfirst.ae/api/v1/leads", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.RF_ORG_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ phone: "+971501234567" }),
});

import os, requests

requests.post(
    "https://replyfirst.ae/api/v1/leads",
    headers={"Authorization": f"Bearer {os.environ['RF_ORG_TOKEN']}"},
    json={"phone": "+971501234567"},
)

A missing, malformed, revoked, or expired token returns 401.

Rotate and revoke

Create a new token before retiring an old one, update your integration, then revoke the old token in settings. Revocation takes effect immediately.

Next