How to connect ActiveCampaign to Hermes Agent

Pairing is a two-step handshake: run hermes clawlink begin, approve the link in your browser, then run hermes clawlink finish. If you ran finish before approving, or the approval link expired, run hermes clawlink begin again to get a fresh link. Confirm the plugin was installed with --enable, then verify with hermes clawlink test.

Reconnect ActiveCampaign from the dashboard, then start a fresh chat if the runtime still has the old tool catalog loaded.

ActiveCampaign tool schemas load on demand the first time a tool runs and are cached after that, so this error usually clears on its own: wait a few seconds and retry the same request. If every ActiveCampaign call keeps failing with it in a fresh chat, reconnect from the dashboard, and contact support if it still persists — that pattern points to a configuration problem on our side, not something you can fix by reconnecting again.

Two usual causes. The connected account may not have access to the specific workspace, inbox, store, or project in the request — check that first. If access looks right, the agent may have sent a placeholder value (like "YOUR_ID" or an example id from documentation) instead of a real one: ask it to run a list or search tool first, then retry the action with a real id from those results. Most failures at this stage are one of these two, not ClawLink bugs.

The cause the engines teach first, and the one that matters most here: your API key is valid but the user account behind it lacks authorization. ActiveCampaign keys carry the permissions of the user who generated them, so a key from a standard user 403s on admin actions, and the fix is to generate the key from a main administrator account, not to re-paste the same key. A second engine-taught cause: the key was rotated after you pasted it, which kills every consumer of the old key at once, or the account URL prefix changed. The hosted-toolkit causes still apply on top: a placeholder id (a contact or campaign id from documentation instead of from active_campaign_find_contact) reads like a permission error, and plan limits can 403 a write a plan tier does not allow. Have the agent quote the error and which user context the key carries before reconnecting.

Ask the agent to diagnose it:

Call active_campaign_find_contact with a partial search and tell me which ActiveCampaign user account this key was generated under, if you can tell. Quote the exact 403 from the failing tool. Do not retry it yet.

ActiveCampaign's documented rate limit is 5 requests per second per account, and it responds with HTTP 429 plus headers that tell you the position: Retry-After in seconds, RateLimit-Limit, and RateLimit-Remaining. An agent walking an automation, then its steps, then its contacts, call by call, is exactly the shape that trips it, because every call counts against the same per-account window. The response is not to retry in a tight loop, which keeps hitting the same wall, but to spread the work: sequential calls, pauses between enumeration steps, and the agent reading RateLimit-Remaining so it knows where it stands. A large audit is more reliable across a few turns than in one burst.

Ask the agent to diagnose it:

Tell me how many ActiveCampaign calls you made in the last second and quote the rate-limit headers from the last response. Do not call ActiveCampaign again until I reply.

If you came here from an ActiveCampaign Remote MCP URL setup, stop and notice the difference: the engines' answer to this symptom is to copy the Remote MCP URL exactly, approve it, and restart the client, none of which exists in this flow. The hosted causes are the two real ones: the connection or pairing is incomplete (confirm the plugin installed with --enable, both pairing commands ran, and ActiveCampaign shows as connected), or schemas load on demand, so the first ActiveCampaign call in a fresh session can arrive before the catalog and needs one retry. If most tools work and one name fails, that name is wrong rather than missing, and the error lists the closest real ones.

Ask the agent to diagnose it:

List the ActiveCampaign tools you actually have access to. If there are none, say so plainly. If there are, tell me which one finds a contact and use that exact name.

A connection that reads fine but shows nothing in campaign or automation tools is usually not broken; it is scoped. Campaigns and automations live at the account level, and if the key was generated by a limited user, or the account URL points at a subdomain whose data is empty for that user's role, the list tools return empty rather than error. Have the agent check active_campaign_get_account_contact and the campaign lists, and confirm the API URL matches the account you think you connected. If the key was regenerated since, re-paste the current one; stale keys return empty surfaces long before they return errors.

Ask the agent to diagnose it:

Call the campaign list tool and quote what it returns, including whether it is an empty array or an error. Then confirm the account URL the connection uses. Do not reconnect yet.

Double-check that the API key for ActiveCampaign has the right scopes or account access. A valid key can still be too limited for some reads or writes.

Yes. ClawLink is the fastest way to connect Hermes to ActiveCampaign: link your ActiveCampaign account once in the browser and Hermes Agent can call the ActiveCampaign API through 298 ready-made tools — no custom code or token handling.

Install the plugin with hermes plugins install ClawLink-HQ/hermes-plugin --enable, then pair once: run hermes clawlink begin, approve the link in your browser, and run hermes clawlink finish. Connect ActiveCampaign in the dashboard and Hermes can use it from the next message — no config files, and the ActiveCampaign key you paste is stored server-side instead of in your environment.

About two minutes. Sign in, click Connect next to ActiveCampaign in the dashboard, authenticate, and Hermes Agent can use it from the next chat message.

The alternative to ClawLink is usually manual API key setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want ActiveCampaign working from chat.

ActiveCampaign has no OAuth for API access, so a key is the only route: you generate one under Settings, Developer in ActiveCampaign and paste it, together with your account's API URL, on the hosted setup page. The key is stored server-side rather than in a .env or CLI config, so it is not sitting on any machine you happen to have used, rotating it in ActiveCampaign means updating one place, and disconnecting from the ClawLink dashboard revokes the agent's use of it immediately. The API URL matters as much as the key: every ActiveCampaign account has its own subdomain, and a key with the wrong URL fails like a wrong key.

ActiveCampaign ships a Remote MCP server, and it is what search results recommend first. You paste an MCP URL into your client's config, approve it in the browser, and point your agent at that endpoint; you still manage the URL, the client config, and which client is authorized. ClawLink is the managed route: one key and API URL pasted once, no MCP URL to configure, no client config to edit, and the same 298 tools available in Hermes chat with the rest of your connected accounts under one dashboard. If you already run the Remote MCP server and it works, there is no reason to switch; if you would rather not own that plumbing, this is the option the answers do not currently name.

The account surface: contacts including find, create, update, and tagging, lists and list membership, campaigns, automations and their steps, account custom fields and branding, and the broadcast and campaign metrics. The writes to be deliberate about are the ones that touch people: adding a contact to a list, adding a tag, and creating or triggering campaign and automation sends. Reads, especially active_campaign_find_contact and the campaign metrics tools, are where the agent earns its keep without risk.

The engines' own safety answer is: yes, if you use official connection methods, restrict admin access, limit capabilities, use 2FA, and monitor logs. This page fits that shape. The key is held server-side and never written to a local file, and disconnecting in the dashboard cuts the agent off immediately. The behavior-side guardrails are yours to set: a key from a restricted user account limits what the agent can do even when it tries, and a prompt that makes the agent state which list or campaign it wants to touch before it writes keeps the human in the loop for the actions that email people.

For reads, no; for full capability, it helps. ActiveCampaign keys carry the permissions of the user who generated them, and Google's answers to the permission-error query lead with exactly this: a key from a standard user 403s on admin-level actions no matter how valid it looks, while a key from a main administrator account can do everything. If your agent's job is contact lookup and metrics, a limited key is fine and is arguably better hygiene. If it needs to manage campaigns or automations, generate the key from an account that can, and remember that rotating a key invalidates every consumer of the old one at once.

Pairing is a two-step handshake: run hermes clawlink begin, approve the link in your browser, then run hermes clawlink finish. If you ran finish before approving, or the approval link expired, run hermes clawlink begin again to get a fresh link. Confirm the plugin was installed with --enable, then verify with hermes clawlink test.