Every signup on your site, straight into your email list

Authentication

Every request carries your workspace key in the X-Api-Key header (a Authorization: Bearer token works too). Get or rotate your key from My App → Developer API in the portal. Treat it like a password — anyone holding it can add contacts to your workspace.

curl https://crossinbox.com/api/v1/ping -H "X-Api-Key: cxi_your_key_here"

A valid key returns {"ok":true,"workspace":"Your Co", …} — the quickest way to confirm your integration.

POST /api/v1/contacts

Adds (or updates) a contact and files it into a list. Lists are created on the fly, so each of your sites or forms can feed its own list just by naming it — no setup step.

cURL

curl -X POST https://crossinbox.com/api/v1/contacts \
  -H "X-Api-Key: cxi_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"email":"jane@example.com","name":"Jane Doe","list":"Website Signups"}'

JavaScript — drop into your signup handler

// After your own signup succeeds (run this SERVER-SIDE so your key stays secret):
await fetch('https://crossinbox.com/api/v1/contacts', {
  method: 'POST',
  headers: { 'X-Api-Key': process.env.CROSSINBOX_KEY, 'Content-Type': 'application/json' },
  body: JSON.stringify({ email: user.email, name: user.name, list: 'Website Signups' }),
});

PHP

$ch = curl_init('https://crossinbox.com/api/v1/contacts');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['X-Api-Key: '.getenv('CROSSINBOX_KEY'), 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode(['email' => $email, 'name' => $name, 'list' => 'Website Signups']),
]);
curl_exec($ch);

Responses

201 Created   {"ok":true,"contact_id":42,"list":"Website Signups","created":true}
200 OK        {"ok":true,"contact_id":42,"list":"Website Signups","created":false}  // already existed — updated
401           {"message":"Missing API key. Send it in the X-Api-Key header."}
403           {"message":"API access is not active for this workspace."}
422           {"message":"The email field must be a valid email address."}
429           Too many requests — the limit is 120/minute per key.