Skip to main content

​
Bearer token (required)

The adapter authenticates with a single static Bearer token. You issue HunterAI a dedicated, read-only token scoped to the endpoints in this spec, and HunterAI sends it on every request:
There is no login step, no token exchange, and no refresh flow — the token is sent as-is until you rotate or revoke it.
Issue a token that can only read the seven endpoints in this spec. HunterAI never writes to your CRM, so a read-only token is sufficient and is the correct least-privilege choice.

​
How HunterAI stores your token

  • The token is written to the connection record and encrypted at rest with Fernet (AES-128-CBC + HMAC). It is never stored in plaintext.
  • It is write-only through the API: the onboarding endpoints accept a token but never return it in any response. Once saved, it cannot be read back — only replaced.

​
Rotating the token

Rotation is a straight replacement, with no downtime if you overlap the two tokens:
1

Issue a new token

Generate the replacement in your CRM. Keep the old one valid for the moment.
2

Update the connection

Your HunterAI business owner PATCHes the connection with the new token (see Go live). The next sync uses it immediately.
3

Revoke the old token

Once a sync has succeeded on the new token, revoke the old one.

​
Revoking access

Revoke the token in your CRM at any time. The next HunterAI request receives 401 and the sync stops — no data is written on our side from an unauthenticated call. Revoking the token is the supported way to cut HunterAI off without deleting the connection.
When a token becomes invalid, every entity fails with an auth error on the next sync. Nothing is partially ingested from that run. Your business owner sees the sync marked failed with an authentication message in HunterAI. See Errors → 401.

​
OAuth 2.0 (on request, not implemented today)

OAuth is not implemented by the adapter. The client sends a static Bearer token and performs no authorization-code exchange, no token refresh, and no client_id/client_secret handshake. Do not build against an OAuth flow expecting it to work today.
If your CRM already speaks OAuth 2.0 and cannot issue a long-lived token, HunterAI can support an OAuth profile on request as a professional-services engagement. It is not part of the v1.0 self-service adapter and has no committed timeline. If you need it, raise it with HunterAI before you start building — the default and only path the adapter implements today is the static Bearer token above.