API keys and webhooks

What this does

Two cards on Settings → Integrations are for developers.

API Keys create bearer tokens for the shop's REST API (/api/v1/…: customers, vehicles, estimates, work orders, invoices, appointments). Key Name is a label; Scopes limits what the key can reach (* for everything). The key is shown once on creation, with copy; after that only its name and prefix are listed. Revoke a key to cut it off.

Webhooks send an HTTP POST to your Endpoint URL when chosen Events happen: estimate_sent, estimate_approved, work_order_completed, invoice_sent, invoice_paid, inspection_completed, booking_created. Each webhook gets a signing secret, shown once, and every delivery carries an HMAC-SHA256 signature over the body so your endpoint can verify it came from the shop. A failed POST is retried twice with a growing delay, then dropped; nothing is queued beyond that.

Before you start

settings.integrations; API and webhook access is a plan feature (api_access), on the Enterprise tier. A developer who will use the key; this page doesn't do anything on its own.

Common problems

I lost the key. Create a new one and revoke the old; keys can't be re-shown.

Webhooks aren't arriving for an event. Only the events listed above are emitted. customer_created and appointment_created exist as names but nothing fires them yet.

Requests return 401. Send the key as Authorization: Bearer <key>, and check it hasn't been revoked or expired.