Sharpspring Authentication

generated: '2026-08-12'
method: searched
source: https://knowledgebase.constantcontact.com/lead-gen-crm/articles/KnowledgeBase/50374-Understanding-Lead-Gen--CRM-Open-API-Overview?lang=en_US
docs: https://knowledgebase.constantcontact.com/lead-gen-crm/articles/KnowledgeBase/50374-Understanding-Lead-Gen--CRM-Open-API-Overview?lang=en_US
note: >-
  Derived from the published Open API overview rather than from an OpenAPI document — SharpSpring
  publishes no machine-readable description, so there are no securitySchemes to aggregate. The API
  uses a single static credential pair (account ID + secret key) generated by an account administrator
  in the application under Settings > SharpSpring API > API Settings. There is no OAuth, no OpenID
  Connect, no scopes, no per-user credentials, and no documented rotation or expiry.
summary:
  types: [apiKey]
  api_key_in: [query, header]
  oauth2_flows: []
  scopes_supported: false
  mtls: false
schemes:
- name: accountID + secretKey (query string)
  type: apiKey
  in: query
  parameters: [accountID, secretKey]
  description: >-
    Both credentials are appended to the endpoint URL, e.g.
    https://api.sharpspring.com/pubapi/v1.2/?accountID={accountID}&secretKey={secretKey}.
    This is the form the provider's own example code uses.
  precedence: >-
    The documentation states that query-string parameters take precedence over the header form when
    both are supplied.
  source: docs
- name: X-Account-Id + Authorization bearer
  type: apiKey
  in: header
  parameters: [X-Account-Id, Authorization]
  description: >-
    The account ID travels in the X-Account-Id header and the secret key is presented as an
    Authorization bearer token. This is a bearer-shaped carrier for the same static secret — it is
    not an OAuth access token and it does not expire.
  source: docs
credential_management:
  issued_by: account administrator, in-application
  location: Settings > SharpSpring API > API Settings
  rotation_documented: false
  expiry: none documented
  revocation_documented: false
  per_user_credentials: false
  scopes: none — a credential is all-or-nothing across the account's data
failure_modes:
- observed: 'HTTP 401 with body "Unable to determine clusterID from provided accountID/secretKey"'
  probe: https://api.sharpspring.com/pubapi/v1.2/
  note: >-
    Observed anonymously on 2026-08-12. The endpoint also sets
    WWW-Authenticate: Basic realm="SharpSpring" on an unauthenticated POST, which is a Basic-auth
    challenge the documented credential model does not actually use.
- documented_error: 103
  message: Header missing `account ID`.
- documented_error: 104
  message: Header missing `Secret Key`.
- documented_error: 105
  message: User authentication failed.
transport:
  https_required: true
  hsts: true
  observed_tls: TLSv1.3
x-evidence:
  fetched: '2026-08-12'
  probes:
  - url: https://api.sharpspring.com/pubapi/v1.2/
    status: 401
  - url: https://api.sharpspring.com/pubapi/v1/
    status: 401
  - url: https://knowledgebase.constantcontact.com/lead-gen-crm/articles/KnowledgeBase/50374-Understanding-Lead-Gen--CRM-Open-API-Overview?lang=en_US
    status: 200