mTLS authentication
Client and server both present X.509 certificates during the TLS handshake, which removes shared secrets.
Developers · Public API · mTLS
Certificate-secured API endpoints for B2B partner integrations
For machine-to-machine access, CrmLeaf offers a public API authenticated with mutual TLS. The calling system proves its identity with a client certificate during the TLS handshake, rather than sending a bearer token that could be copied.
- Free trial
- No credit card
- Free onboarding
Partner integration · mTLSMachine-to-machine
- 1✓
Client presents certificate
CN=partner-erp.example.com
- 2✓
CrmLeaf verifies the client
Certificate valid
- 3✓
Server presents certificate
Verified by the client
$ curl --cert partner.crt --key partner.key \
https://partner-api.example.com/…
HTTP/2 200 · mutual TLS established
Auth
Client certificate
Bearer token
Not required
How a Public API call works
From certificate to processed request
- 01
Partner system
Presents its client certificate
- 02
mTLS handshake
Both sides verify each other's certificates
- 03
Identity confirmed
Cryptographic, not token-based
- 04
Request processed
Only after the handshake succeeds
What the Public API provides
Built for machine-to-machine, not scripting
Partner identity
Each partner system is identified by its own certificate, not by a token that could be forwarded or copied.
B2B data exchange
Built for automated server-to-server flows such as ERP sync, partner data feeds and billing platform integration.
No bearer token
Personal access tokens are for the REST API and AI assistants. The Public API identifies the calling system by its certificate instead.
Add-on module
The Public API is a platform add-on module, enabled per account. Confirm plan inclusion before you build on it.
Set up with our team
Certificate setup for a partner integration is arranged with the CrmLeaf team, so talk to us before you start.
In detail
Public API vs REST API
CrmLeaf offers two API surfaces with different credentials. The REST API uses personal access tokens - a token acts as the user who issued it, with that user's permissions - and suits first-party integrations, scripts and AI assistants. The Public API uses mTLS certificates and suits machine-to-machine integrations where the calling system itself must be identified. Both are add-on modules and can run side by side.
- mTLS
- Client certificates
- Machine-to-machine
- Add-on module
Built in
- A bearer token is a string anyone can use if they obtain it; a certificate is bound to the private key on the calling server
- Authentication happens during the TLS handshake, so a call without a valid certificate is refused before any request is processed
- Each partner system can be identified by its own certificate
- Use it when the integration is machine-to-machine and the partner needs certificate-level security, or when long-lived token rotation is hard for them
- For a person's own scripts or an AI assistant, use a personal access token with the REST API or the MCP server instead
Frequently asked questions
Planning a partner integration?
Book a call to confirm the Public API fits your system and arrange certificate setup with our team.