Skip to content
SessionboardSessionboardSessionboard Help Center

CRM API authentication

Scopes

ScopeWhat it allows
read:crmRead your contacts, tags and connections; export; read a spreadsheet’s columns, preview an import, and discover people in a connected app (these only read)
write:crmAdd, change, tag and delete contacts; add notes; create, rename and delete tags; import; connect, test and disconnect apps

read:crm and write:crm are preview scopes: a token or OAuth client gets them only when they are named explicitly, and they are not listed in scopes_supported. A token whose scopes do not include the one an operation needs gets 403 SCOPE_REQUIRED. Another organization’s id anywhere in the path returns 404.

The token’s user needs the organization’s Contacts permissions for what the call does (read, update, export, delete). Connecting and disconnecting apps need an organization admin.

API tokens

An organization admin creates a token in Sessionboard under Organization Settings → API Tokens, names read:crm and, to make changes, write:crm, and copies the token when it is shown: it is displayed once. Send it in the x-access-token header:

Terminal window
curl "https://public-api.sessionboard.com/v1/organization/{orgId}/crm/contacts?type=speaker" \
  -H "x-access-token: <api-token>"

A token restricted to particular events cannot use the CRM operations, because they act on every contact in the organization (403 ORG_WIDE_TOKEN_REQUIRED).

AI assistants

Claude, ChatGPT, Copilot and Gemini connect to the Sessionboard MCP server by signing in with OAuth; there is no token to copy. OAuth clients request read:crm and write:crm by name and send the access token as Authorization: Bearer <access-token>.