Reference
Developer FAQ
Common questions about keys, real-time sync, fields, rate limits, and security for the Sync Users & Subscribers integration.
A publishable key (zk_pub_...) is create-only and safe to expose in your website source: it can add contacts but cannot read, search, edit, or write privileged routing fields. A secret key (zk_live_...) can do everything: create, read, search, and write privileged fields. Use publishable keys in the browser and keep secret keys on your server.
Yes. Whether a contact arrives via the no-code embed, the REST API, or the MCP server, it appears on your Zoye Leads page in real time. There is no batch delay or manual import step.
Yes. Set type to company on the REST API, or add data-type="company" on the embed snippet, to create company leads instead of person leads. Company leads land in the Companies section of your Leads page and can carry linked member contacts.
Standard fields (name, email, phone, company, position, type, source, notes, address, city, country, website, linkedIn, twitter, lastContactedDate, customFields, and more) sync with any key. Privileged fields (tags, status, lifecycleStage, assigneeId, assignedUserIds, watchingUserIds, linkedContactIds, linkedNoteIds) sync only with a secret key. The full list is on the Field reference page.
Yes. Each key has a rate-limit tier tied to your plan, which you can check by calling GET /public/v1/whoami and reading the rateLimitTier field. The batch endpoint accepts up to 100 contacts per request, which is the most efficient way to send many contacts at once.
Yes, that is what publishable keys are for. A publishable key can only create contacts using standard fields. It cannot read or search your data, edit existing records, or write privileged routing fields. The worst a third party could do with it is submit contacts, which your public form already allows.
Open the Sync Users & Subscribers connector in the Zoye app, find the key, and revoke it. Revocation takes effect immediately and any request using that key stops working. Because you can create multiple keys, you can rotate one out without disrupting your other integrations.
Yes. That is the outbound direction of the connector: webhooks. Add an endpoint URL in the Sync Users & Subscribers connector under Send updates out, choose which events to receive, and Zoye POSTs an HMAC-signed JSON payload whenever a contact is created, updated, changes stage, or is archived. Verify the X-Zoye-Signature header against your endpoint secret, then respond with a 2xx. Failed deliveries retry with exponential backoff and can be replayed from the app.