Docs

Authentication

Every request carries an API key that starts with sk_live_, sent as a Bearer token. Keys are stored only as SHA-256 hashes, can be revoked at any time, and carry scopes on the v2 routes. Webhooks are signed with HMAC SHA-256 so you can check that they came from Sellinger.

Published by Sellinger AI. Numbers and settings checked on 19 October 2026 against the fact register. Report an error.

API keys

Format: sk_live_ followed by 48 hexadecimal characters. A key without that prefix is rejected.
The raw key is returned once, when it is created. Sellinger keeps only a SHA-256 hash and the first 16 characters for display.
A team can have up to 5 active keys. Creating a sixth returns an error until you revoke one.
Revoking a key makes it fail on the next request.
Keys can carry an expiry date that is checked on every request. The key creation call does not set one.

Scopes on the v2 routes

Scope presets when a key is created
Preset	Scope granted	What it allows
leads	leads:write	Read and write leads
mcp_read	mcp:read	Read everything on the v2 MCP routes
mcp_full	mcp:full	Read and write everything on the v2 MCP routes

A route needs the scope of its resource and method, for example leads:read. A write scope also allows reading. Without the scope the route answers 403. The v1 routes check the key but do not apply these scopes.

A team member with the Viewer role is read only, so writes made with that person's key are refused.

Verifying webhook signatures

Set a webhook URL, the events you want and a signing secret under the webhooks integration in the app. Sellinger sends a JSON POST for each event with these headers:

Headers on every webhook delivery
Header	Value
X-Sellinger-Signature	HMAC SHA-256, as hex, of the raw request body, keyed with your signing secret
X-Sellinger-Timestamp	The time of the delivery
X-Sellinger-Event	The event name
X-Sellinger-Event-ID	A unique id for the event

The timestamp is not part of the signed text, so the signature alone does not prevent replay. Store the event id and ignore repeats.

Check the signature in Node

import crypto from "node:crypto";

function isFromSellinger(rawBody, signature, secret) {
  const expected = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Events you can choose are INVITE_ACCEPTED, CONVERTED, INTRO_SENT, STATUS_CHANGED, AWAITING_ACCEPT, ACTIVE_CHAT, RESPONDED, FOLLOWUP_SENT and LIVE_CHAT_ESCALATED. A delivery times out after 30 seconds. Each attempt is recorded in the webhook log, and you should not assume Sellinger retries a failed one.

The MCP connector

The hosted MCP connector at https://app.sellinger.ai/api/v2/mcp signs in through OAuth, with no key to paste. Access tokens last 8 hours and refresh for up to 90 days. An API key also works on the same route. See the MCP page.

Common questions

Where do I create a key?

From the API integration in the app. The key is shown once.

Is the key tied to a team?

A key created for a team is scoped to it. If the key has no team, send an x-team-id header on the v2 routes. A different team id returns 403.

How do I rotate a key?

Create a new one, switch your code over, then revoke the old one.

Sources and method

Sellinger API code read on 19 October 2026. The in-app reference is at app.sellinger.ai/docs. No OpenAPI file exists yet.