> ## Documentation Index
> Fetch the complete documentation index at: https://docs.instantcampaign.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Developer tools overview

> Connect your own systems to InstantCampaign with API keys, outbound webhooks, the transactional email API, the API request log and the MCP server.

InstantCampaign has a public API for your own applications, outbound webhooks that tell your servers when something happens, and an MCP server that lets AI assistants work with your workspace. Everything developers need in the app is in one place: **Settings → Developers**.

## What is under Settings → Developers

| Page              | What it is for                                                                                               | Who can open it                                                                         |
| ----------------- | ------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------- |
| **API Keys**      | Create and delete the keys your applications use to call the API, and limit each key to specific permissions | Owners, Admins, or a custom role with the **API keys: manage** permission               |
| **Webhooks**      | Send an HTTP POST to your server when contacts, campaigns, emails or forms change                            | Members who can change workspace settings (adding and deleting needs an Owner or Admin) |
| **API log**       | See every API call your keys made, with the request and response bodies and what each call produced          | Owners, Admins, or a custom role with the **API keys: manage** permission               |
| **API reference** | The full, interactive description of every endpoint (OpenAPI 3.1), for members of this workspace             | Every member                                                                            |

<Note>
  The API and webhooks act on the workspace that owns the key or the webhook. If you belong to several workspaces, switch to the right one before you create a key.
</Note>

## Where to start

<CardGroup cols={2}>
  <Card title="Create an API key" icon="key" href="/guides/developers/api-keys">
    Create a key, pick its permissions and make your first call.
  </Card>

  <Card title="Receive webhooks" icon="webhook" href="/guides/developers/webhooks">
    Subscribe to events and verify that each delivery really came from InstantCampaign.
  </Card>

  <Card title="Send transactional email" icon="envelope" href="/guides/developers/transactional-email">
    Send receipts, password resets and notifications from your app with a template and a JSON payload.
  </Card>

  <Card title="Read the API log" icon="scroll" href="/guides/developers/api-request-log">
    Find out why an email went out, with which data, and from which key.
  </Card>

  <Card title="Connect an AI assistant" icon="robot" href="/guides/developers/mcp-server">
    Give Claude, an IDE or an agent framework access to your workspace through MCP.
  </Card>

  <Card title="API reference" icon="code" href="/api-reference/introduction">
    Every endpoint, parameter and response.
  </Card>
</CardGroup>

## How requests are authenticated

Every call to the public API sends a workspace API key as a bearer token:

```bash theme={null}
curl https://instantcampaign.ai/api/v1/lists \
  -H "Authorization: Bearer ic_your_key_here"
```

Keys always start with `ic_`. A missing, unknown or expired key gets `401 Invalid or missing API key` (`Invalid or expired API key` on the transactional endpoints). A key that lacks the permission an endpoint needs gets `403` with `code: "insufficient_scope"`. Most endpoints also name the missing scope in `requiredScope`. Transactional send and validate, public events and the MCP server don't, so check `code`. See [API keys](/guides/developers/api-keys) for the scopes.

## Rate limits

Limits are counted per workspace, not per key, over a one-minute window. Most endpoints allow 60 requests per minute. Recording events allows 300 per minute, and sending, validating or checking the status of transactional email allows 100 per minute each. Going over the limit returns `429 Rate limit exceeded`. The [API reference](/api-reference/introduction) lists the limit for each endpoint.

## Suspended workspaces

If a workspace is suspended, its API keys stop working too: every call answers `403` with the workspace-suspended code until the suspension is lifted.