CiviCRM has multiple layers of security, all of which need to be handled properly to update its data remotely. You need to create a user which will be provided the permissions needed to update data in CiviCRM from Attentive.ly. This is part of the CiviCRM permissions model for using an external programmatic interface to interact with CiviCRM (see https://wiki.civicrm.org/confluence/display/CRMDOC/API+Security#APISecurity-PermissionswithinAPI for more details - that page is dated but I think generally accurate still). This approach to permissioning allows different external services to interact with different permissions, leverages the existing user/contact based permissioning system, and allows tracking of changes made by services to follow the paradigm set up for tracking which user makes changes to a contact.
@Andrei's suggestions are good ones. The official documentation for creating API user keys is at https://wiki.civicrm.org/confluence/display/CRMDOC/REST+interface#RESTinterface-CreatingAPIkeysforusers . I've added updated instructions that do not require interacting directly with the database at How do I set up an API key for a user?
