API keys and integrations

Two tabs in Settings handle this: Integrations for API keys and webhooks, and Connected apps for app authorisations.

Creating an API key

Open Settings → Integrations, then click New API key. Give it a name so you remember what it’s for, and click Create.

The key is shown only once. Copy it before you close the window. You can’t recover it later, and from then on the table shows only its prefix. If you lose it, revoke it and create a new one.

The keys table shows the name, key prefix, creation date, last use and status. Last use is genuinely useful for spotting keys that nothing calls any more.

Revoking is immediate and permanent. Click the bin icon and confirm. Everything that uses that key stops working straight away, including connections built on it. The row stays in the table, marked Revoked, for your records.

Webhooks

Webhooks push events to a URL you choose. Click Add endpoint, paste the address and tick the events you’re interested in. You can pick individual events or all of them at once.

The signing secret is shown once, when you create the endpoint, exactly like an API key. Your receiver uses it to verify that a signed POST really came from your account.

Each endpoint shows its state: OK with the time of the last success, Errors with the time of the last failure, or a note that there have been no deliveries yet.

Failing endpoints are paused automatically. After a series of failed deliveries, an endpoint is marked as automatically disabled. Fix the receiving side, then turn it back on with the refresh button. You can also switch any endpoint between Active and Disabled yourself, or delete it.

You can get an email when an endpoint is disabled automatically. You’ll find that toggle in the Notifications and privacy section, see Account settings.

Connected apps

This is the second tab. It shows the apps authorised on your account through a connector, along with the address you paste into an app to connect it.

Each connection shows the app name, the date it was connected, its last use and its scope of access. The scope is described in plain language: reading your account, making changes you approve, and staying connected without logging in again.

Disconnecting removes access immediately. Confirm, and the app is disconnected on the spot. You can connect it again later. The Disconnect all button removes every connection in one go.

Recent activity is a log of the latest actions connected apps have taken on your account, so you can see what was actually done, not just what was allowed.