I have a client who would like API access so they can manage and prune the list of contacts from their own databases and web site. I have no problem with this.
However, I'm not sure if giving them my API access key will allow them to see my company mailing list, my other clients I manage on Campaign Monitor and their email lists as well.
Can someone let me know if I give them my API key and their client key they will ONLY see their stuff?
Hey berchman, on top of the API key, they'll also need their subscriber list ID. As long as you only provide the ID for their subscriber list, they can only interact with that list from the API.
Perfect! Thanks Dave—exactly what I needed to know.
What Dave's explained is cool for the one particular application of the API that you are asking, however moving forward, we will be providing more methods for interaction that may only require the API Key to work.
This means that by providing it to your clients is probably not the best idea at all, as down the track, they may indeed be able to use it to access your other data. API access should be restricted to your dev/design house, unless of course it's integrated into some app you've built for the client.