Connect Intellayer to the rest of your business
A documented REST API and signed webhooks on the Pro and Enterprise plans, and an MCP server that connects Claude, ChatGPT or Copilot on every plan — built so a key, a token or an endpoint that ends up in the wrong hands can do as little as possible.
Connect Claude, ChatGPT or Copilot: the Intellayer MCP server
Intellayer runs its own MCP server. Add it to Claude, ChatGPT, Copilot or any AI app that accepts custom connectors, and ask about your customers, leads, tasks and invoices in plain language — answered from your Intellayer records, next to your email and documents.
Connect in three steps
- An account admin switches on the Connect your AI apps add-on in Settings. It has no price of its own.
- In your AI app, add a custom connector (MCP server) with the address shown in Settings › Connected AI apps.
- The app opens a Intellayer page: sign in and choose Allow.
What it can and cannot do
- Read-only. The app can look records up and query them; it cannot create, change or delete anything.
- As you. Each person connects their own app, and it sees exactly what their role lets them see.
- Five tools. List what can be queried, describe a record type, run a query, read customer health scores, and look up how something is done in Intellayer.
- Standard sign-in, no key to paste. OAuth with PKCE and dynamic client registration. Access tokens last an hour; refresh tokens rotate, and an app left unused for 30 days has to be allowed again. Every call checks the person, the organisation, the add-on and the admin switch afresh.
- Mailbox and calendar data stay in Intellayer. Email filed from a connected mailbox, calendar events and time off are never passed to an AI app.
- Yours to switch off. Anyone can disconnect their app under Settings › Connected AI apps. An account admin sees every connected app in the organisation and can switch connections off for everyone at once.
- You choose who may connect. By default Owners, Admins, Managers and Staff; never the Read-only or Accountant roles. Custom roles start without it.
- On the record. Every call an AI app makes is in the audit log.
- Your app, your AI subscription. Answers go to the app you connected, not to our AI provider, and do not use your Intellayer AI allowance. What the app does with them is covered by its own terms.
Read and write your records
List, read, create and update leads, customers and companies; list, read and create tasks; read proposals, invoices and pipeline stages. An OpenAPI document describes all of it for Postman and similar tools.
Hear about changes as they happen
Eighteen webhook events across leads, customers, companies, tasks, proposals and invoices — from lead.stage_changed to proposal.accepted, invoice.paid and invoice.overdue.
Use the tools you already have
Any tool that can call a REST API works with a key made under Settings, API and webhooks — Make, n8n, Zapier or your own code. Webhooks can be created through the API as well.
Documented in public
The API reference and the webhook guide are public, with search, every endpoint’s detail and example payloads.
Open the docs →API keys that limit the damage
- Every key acts as the person who made it, with a role you choose — it can never do more than that role, or that person, can.
- Restrict a key to your own IP addresses or ranges.
- Keys expire: after 90 days unless you choose otherwise, after a year at most, with reminders 14 and 3 days before.
- A new key sees no personal data until you allow it: names, email addresses and phone numbers come back redacted.
- Creating or rotating a key asks for your two-step code or password, and every Owner of the organisation is emailed.
- Owners are alerted to unusual use — a new IP address or country, a sudden spike, a run of refused requests — and can have a key suspended automatically.
- Keys start with
ascpk_and carry a checksum, so a key pasted somewhere it shouldn’t be is easy to recognise.
Short-lived tokens instead of a standing secret
Exchange a key’s credentials for an access token that lasts an hour, with the standard OAuth 2.0 client-credentials flow at /api/public/v1/oauth/token. Prove who you are with a signed assertion from your own key pair (private_key_jwt) instead of a shared secret if you prefer, and switch your organisation to tokens only, so a raw key is refused.
Webhooks that only go where you meant them to
- Verified destinations. Nothing is sent until your endpoint answers a one-time challenge, and the check repeats every 30 days, so an address that changes hands stops receiving.
- Signed. Every delivery carries an HMAC-SHA256 signature over its timestamp and body in
X-Webhook-Signature. After you rotate the secret, the old one keeps signing alongside the new one for 24 hours. - HTTPS to the public internet only. Private and local addresses are refused, known request-inspection services are blocked, and you can limit webhooks to your own domains.
- Thin by default. A delivery carries the record’s id and where to fetch it, so reading the data still takes an API key. Full payloads are an option.
- Your own header. Add an authorisation header that is sent with every delivery.
- Changes are noticed. Creating a webhook, changing its address or asking for full payloads needs your two-step code or password, and every Owner is emailed.
Deliveries you can rely on
- A failed delivery is retried, eight attempts in all over about 45 hours.
- The delivery log shows each delivery, with a resend button and Resend all failed.
- A failing endpoint is switched off only after 20 failures in a row and a whole day without a delivery. While it is off, its deliveries wait, and go out when it is switched back on.
Because of the challenge, a webhook has to point at something you control: your own server, or an automation tool that lets you set the response it sends back.
One budget per organisation
All of an organisation’s keys share one budget of requests per minute: 120 on Pro, 600 on Enterprise. Up to ten keys can be active at once, and each can be held below the budget.