Authentication

An API key stands for your whole account. If your CRM fetches yesterday's visits every night, for example, it sends the Visitor Intelligence key. Webmetic then returns the companies that visited your websites.

The API has no users, roles, or Bearer tokens. Whoever has the key reads all of the account's data.

What the API checksCopy Anchor Link

On the visit endpoints, Webmetic checks every request in this order and stops at the first error:

1. 1HeaderIf the Authorization header is missing, the API answers with API_KEY_MISSING.
2. 2FormatIf the format is wrong, for example because of a Bearer prefix, API_KEY_INVALID follows.
3. 3KeyIf the key belongs to no account, API_KEY_NOT_FOUND follows.
4. 4DomainIf domain does not belong to this account, API_KEY_NOT_AUTHORIZED follows.

The three keysCopy Anchor Link

Admins find the keys under Menu > Integrations > API. Other users don't see the API keys window and ask an admin for the key. If a partner manages your account, the partner decides whether API appears in the menu.

Webmetic creates the Visitor Intelligence key at sign-up. If a card shows the note No key generated yet., click Generate key. The Copy icon copies the whole key, even while it is masked.

Each key only works on its own endpoints. If you send the Visitor Intelligence key to /enrichment/*, for example, the API answers with ENRICHMENT_KEY_NOT_FOUND.

A key starts with wmtc_, followed by 32 letters and digits, an underscore, and an eight-character checksum. All three keys use this format.

The exception is the public demo key wmtc_demo, which Webmetic recognizes as a fixed value. It's for testing only, works on every endpoint, and returns invented data. For details, see Try it without an account.

Key in the headerCopy Anchor Link

Send the key unchanged in the Authorization header, without a Bearer prefix.

curl "https://hub.webmetic.de/company?domain=your-website.com&page_size=3" \
  -H "Authorization: wmtc_YOUR_API_KEY"

On the visit endpoints, domain must belong to your account. Enter the domain exactly as it appears under Menu > Websites.

With the key of a partner account you also read your customers' domains. For details, see Partner API.

New keyCopy Anchor Link

If a key has fallen into the wrong hands, generate a new one. The old key stops working at once. This cannot be undone.

1. In the key's card, click Regenerate. For three seconds the button asks for confirmation.
2. Click it again within that time. Webmetic shows the new key.

From now on, the API answers requests that use the old key with API_KEY_NOT_FOUND.

Enter the new key everywhere the old one was used: in n8n, Make, Zapier, and your own scripts. If you regenerated the Data Layer key, enter it in the Matomo plugin too.

Your webhooks keep running, because they belong to the account and not to the key.

You can only regenerate the Enrichment key during the trial, on Growth, and on Enterprise.

On Starter and Free it can't be replaced, but an existing key keeps reading your lists. This doesn't apply if your account can't use Enrichment at all, for example after a cancellation (ACCOUNT_NOT_ELIGIBLE).

Key errorsCopy Anchor Link

If something is wrong with the key, the API answers with status 403. The body has the same shape as every API error:

{
  "detail": {
    "error": "API_KEY_MISSING",
    "message": "Send your API key in the Authorization header."
  }
}

Evaluate detail.error in your code. The text in detail.message is meant for people and can change.

A request with a valid key can still fail because of the plan. The API returns PLAN_REQUIRED in two places only.

Without Growth, Enrichment refuses new lists, new domains, and single lookups. On /contacts/*, the error concerns companies that are hidden on the Free plan.

Every other error code is listed under Errors.

Next stepsCopy Anchor Link