Kommo API Key Setup
How to generate, scope and rotate a Kommo long-lived access token. Screenshots, gotchas, and permissions checklist for safe integrations.
Where to find the API key screen
Kommo → Settings (bottom-left) → Integrations → Create integration → Private. This creates a long-lived token bound to your account.
Minimum scopes for AI enrichment
Grant only what you need. For a copilot integration:
- Leads: read + write
- Contacts: read + write
- Companies: read
- Notes: write (to post enrichment notes)
- Tasks: write (to suggest next actions)
Rotate every 90 days
Long-lived tokens are convenient but they never expire on their own. Set a calendar reminder to rotate. In KommoAi, updating the key is a single field — no downtime.
Common errors and fixes
401 Unauthorized usually means a stale token or wrong subdomain. 403 means the integration is missing a scope. 429 means Kommo rate-limited you — back off exponentially, never hammer.
FAQ
Is OAuth better than a long-lived token?
For end-user apps, yes. For a private copilot on your own workspace, a scoped long-lived token is simpler and secure enough.