BrightshoalDocsOpen console
    MenuProvider credentials

    API reference

    Provider credentials

    Bring your own provider accounts (model, voice and telephony providers). Secrets are encrypted at rest and never returned.

    List provider credentials

    GET/api/integrations

    Which providers have a credential stored for the project (model, speech and telephony providers), with when it was saved; the secrets themselves are never returned. Credentials belong to one project; an org-wide key must name project_id.

    Secret API key. How it works

    Query parameters

    • project_idstring

      The project. Required with an org-wide key.

    Returns

    200 OK

    Response attributes

    • dataarray of Integrationrequired

      4 attributes

      • providerstringrequired

        Provider slug, e.g. openai, deepgram, elevenlabs, twilio.

      • key_versionintegerrequired

        Master-key version the secret is sealed under.

      • created_atstringrequiredISO 8601 timestamp

      • updated_atstringrequiredISO 8601 timestamp

    • 400 Validation error: usually invalid_request, with the failing fields in issues when there are any
    • 401 Missing, malformed, unknown or revoked API key (unauthorized)
    • 404 Not found, or outside what the key can see
    • 429 Rate limit exceeded (rate_limited). Wait Retry-After seconds. Budgets are per 60-second window: developer API 120 per key and 600 per organization; public chat 30 per IP address, except polling for updates (60 per conversation and IP address) and analytics events (120 per IP address).
    GET /api/integrations
    curl "https://api.myleadsfactory.tech/api/integrations" \
  -H "Authorization: Bearer $MLF_API_KEY"
    Response 200
    {
  "data": [
    {
      "provider": "string",
      "key_version": 1,
      "created_at": "2026-10-28T09:30:00.000Z",
      "updated_at": "2026-10-28T09:30:00.000Z"
    }
  ]
}

    Save a provider credential

    PUT/api/integrations/{provider}

    Saves your own account's key for a provider, so assistants in the project run on it. It is stored encrypted and never returned. Where the provider can be checked, the key is tried first and a refused key is not stored (422). verified: false means it could not be checked; it is stored anyway.

    Secret API key, not read-only. How it works

    Path parameters

    • providerstringrequired

      Provider slug as assistants name it in provider, for example openai, deepgram, elevenlabs, twilio.

    Request body

    • project_idstring

      Required only for an org-wide key.

    • secretstringrequiredup to 8192 characterswrite-only, never returned

      The raw provider secret (API key, or a JSON blob for multi-field providers). Encrypted at rest; never returned.

    Returns

    200 OK

    Response attributes

    • dataIntegrationStatusrequired

      4 attributes

      • providerstringrequired

      • project_idstring

      • configuredbooleanrequired

      • verifiedbooleanrequired

        True when the provider accepted the key on save. False when it could not be checked (no check for this provider, a scoped key, or the provider was unreachable); the key is stored either way.

    • 400 Validation error: usually invalid_request, with the failing fields in issues when there are any
    • 401 Missing, malformed, unknown or revoked API key (unauthorized)
    • 403 Refused, for example a read-only key on a write (read_only_key), a role too low for the route (insufficient_role), or a route that needs a console session
    • 404 Not found, or outside what the key can see
    • 422 credential_rejected: the provider refused the key. Nothing is stored.
    • 429 Rate limit exceeded (rate_limited). Wait Retry-After seconds. Budgets are per 60-second window: developer API 120 per key and 600 per organization; public chat 30 per IP address, except polling for updates (60 per conversation and IP address) and analytics events (120 per IP address).
    PUT /api/integrations/{provider}
    curl -X PUT "https://api.myleadsfactory.tech/api/integrations/PROVIDER" \
  -H "Authorization: Bearer $MLF_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "secret": "whsec_..."
}'
    Response 200
    {
  "data": {
    "provider": "string",
    "project_id": "proj_5f0c2a9e7b1d4c3e8a6f0b2d4c6e8a1f",
    "configured": true,
    "verified": true
  }
}

    Remove a provider credential

    DELETE/api/integrations/{provider}

    Deletes the project's stored key for this provider.

    Secret API key, not read-only. How it works

    Path parameters

    • providerstringrequired

      Provider slug as assistants name it in provider, for example openai, deepgram, elevenlabs, twilio.

    Query parameters

    • project_idstring

      The project. Required with an org-wide key.

    Returns

    200 OK

    Response attributes

    • dataIntegrationDeleteResultrequired

      2 attributes

      • providerstringrequired

      • deletedbooleanrequired

    • 400 Validation error: usually invalid_request, with the failing fields in issues when there are any
    • 401 Missing, malformed, unknown or revoked API key (unauthorized)
    • 403 Refused, for example a read-only key on a write (read_only_key), a role too low for the route (insufficient_role), or a route that needs a console session
    • 404 Not found, or outside what the key can see
    • 429 Rate limit exceeded (rate_limited). Wait Retry-After seconds. Budgets are per 60-second window: developer API 120 per key and 600 per organization; public chat 30 per IP address, except polling for updates (60 per conversation and IP address) and analytics events (120 per IP address).
    DELETE /api/integrations/{provider}
    curl -X DELETE "https://api.myleadsfactory.tech/api/integrations/PROVIDER" \
  -H "Authorization: Bearer $MLF_API_KEY"
    Response 200
    {
  "data": {
    "provider": "string",
    "deleted": true
  }
}