Enhanced Account Security
About Enhanced Account Security
To provide stronger protection for your data, the CRM includes an Enhanced Account Security feature. This setting is enabled by default for all accounts and is designed to limit certain automated API functions that could pose a security risk if an API key were compromised.
What Enhanced Security Does
When Enhanced Account Security is active, the following changes take effect:
- Manual API Key Generation: API keys for new locations are no longer generated automatically. You must create them manually within the CRM's user interface.
- API Keys Hidden from API Responses: API keys are excluded from the responses of Location CRUD (Create, Read, Update, Delete) APIs. You must log into the CRM interface to view them.
- Legacy User APIs Disabled: The older API v1 endpoints for creating, updating, and deleting users are disabled to prevent potential unauthorized account access.
User Management Permissions and API Access
Enhanced Security also restricts API-based changes to user management permissions. If your agency relies on automated workflows that require the API to manage users, you can disable Enhanced Security to allow this. This action increases security risk and should only be done if necessary.
To disable Enhanced Security, navigate to Settings > Company > Advanced Settings. Disabling the setting permits API-based updates for the following user permissions:
- View & Manage Users: Allows creating and editing users via the API.
- View Users: Allows viewing user information via the API.
Important Recommendation
We strongly advise keeping Enhanced Account Security enabled. Disabling it increases the vulnerability of your account and data. The option to opt-out is available in your settings, but it should only be used if your specific business processes require it.