Source tokens

A source token is a ready-made address an outside source posts its data to. The access sits in the link itself, no header required. That lets in systems where nothing can be configured except a field for an address: lead forms on ad platforms, form builders, a contact form on somebody else's page.

The access sits in the address

The address ends in a long token, and whoever knows it may do exactly one thing: create a record. Reading, changing or exporting does not work through it. That is precisely why it is defensible to hand it to an outside account you have no control over.

It stays retrievable, on purpose

Unlike a key, a source token can be displayed and copied again at any time. It sits over in the ad account anyway; hiding it here would be a gesture, and one that costs work every week, because nobody could look up which token hangs on which campaign.

Entity and origin are fixed beforehand

When you create the token you pick the entity it writes into and an origin name. The source then has to send neither, and both end up on the record. You can see in the list where it came from, and filter, report and distribute by it.

Revoke rather than replace

A token has no grace period. It hangs on an ad or a form, and over there you swap the address instead of replacing it. Revoking takes effect at once, and the source delivers nothing after that until the new address is in place.

Step by step

1. Open Settings, API and the Sources tab.
2. Press New source and name it after the ad or the form it will hang on.
3. Enter an origin name. It will stand on every record from this source.
4. Pick the entity. Without one, the source has to send it with every call.
5. Copy the address and enter it as the target on the other side.

Can I use the same token for two ads?

Technically yes, sensibly rarely. Two tokens cost nothing, and afterwards every record says which of the two brought it.

The source uses different field names than we do. Is that a problem?

Not a fatal one. Unknown keys are accepted and set aside, the record is created anyway, and the response names them as warnings. It gets clean once you enter the field keys from the documentation on the other side.

Can the source send flat?

Yes, and most of them do. Ad accounts and form builders send a flat bundle of form fields, which is exactly what the flat spelling is for.

Does the token appear in the log?

No. The path is shortened before it is stored, and three asterisks stand where the token was. A log that is open for troubleshooting should not hand out accesses.

What if somebody guesses the address?

They can create records, nothing else. If that happens, you revoke the token and enter a new one on the other side.