Legacy endpoints

Before the v1 API, integrations used the Zapier integration and the POST /customer/external endpoint. Both still work for back-compat, but are superseded by this API.

What is legacy

The old Zapier integration, which wrapped the same legacy endpoint.
POST /customer/external, which took a plaintext apiKey in the request body, was scoped per user rather than per project, and had no scopes or rate limits.

These are deprecated. They continue to work with no removal date in v1, but new integrations should use the v1 API. Sending an API key in a request body is discouraged; use the Authorization header instead.

Mapping to v1

Legacy behavior	v1 equivalent
API key in the request body (apiKey field)	`Authorization: Bearer cfy_live_...` header (or `X-API-Key`).
Upsert on create (create or update in one call)	Explicit `POST /contacts` to create, or `PATCH /contacts/{contactId}` to update. Check with `GET /contacts?email=` first.
Per-user key	Per-project (tenant-scoped) key; data access is limited to the key project.
No scopes	Scoped keys (`contacts:read`, `contacts:write`, `interactions:write`, `webhooks:manage`).
No rate limits	120 requests/minute per key, plus 600/hour on `POST /contacts`.
Zapier polling for changes	Outbound webhooks push events to your endpoint.

Recommendation

Build new integrations on the v1 API. Start with Getting started and Authentication. If you already depend on the legacy endpoint, plan a migration to a project-scoped key and the v1 contact endpoints when convenient.