When a native integration or Zapier doesn't fit, build directly against the Anvil API. This guide covers the patterns we recommend for reliable custom integrations.
Reach for a custom integration when you need:
For simple point-to-point automations, [Zapier or Make](/docs/integrations/zapier-make) is faster to ship.
Most custom integrations fall into one of three shapes:
Prefer webhooks for anything time-sensitive — they push changes the moment they happen and keep you well under rate limits. Use polling only for periodic reconciliation. If you poll, cache aggressively (lead lists change slowly), honor the cursor in the response meta, and back off on 429.
All requests use a Bearer API key:
curl -X GET https://api.anvilhk.com/v1/leads \
-H "Authorization: Bearer anv_live_sk_49kPz9..." \
-H "Content-Type: application/json"Scope keys to the narrowest permission set the integration needs, and rotate them every 90 days. See [Authentication](/docs/api-reference/authentication) for scopes and rotation.
A robust nightly sync into a data warehouse:
If you're building an app that serves multiple Anvil customers, don't ask each for a static key. Use the OAuth 2.0 flow instead:
https://api.anvilhk.com/v1/oauth/authorize?client_id=...&scope=read:leads&redirect_uri=...The authorization-code grant returns a refresh token per customer, so you never store long-lived secrets.
Full endpoint documentation lives in the [API Reference](/docs/api-reference). For an architecture review or a partner OAuth app registration, email 738888@proton.me.