Integrations

API keys

Settings → API keys. Bearer tokens for scripts and integrations to call the API on your behalf. Unlike the rest of this section, this one isn’t admin-only — it’s self-service: you manage keys you created, and a workspace admin can manage everyone’s.

Creating a key asks for a name, a set of scopes, an optional mailbox filter, and an expiry:

• Scopes are bundles, not individual API calls — things like conversations, customers, tags, workflows, each with its own read and write checkbox. A handful of bundles (satisfaction, search, settings, users) are read-only, no write option. Workspace admins also get an “Administrative access (tenant admin)” bundle for a key with full admin rights — everyone else’s scope choices are capped at whatever they themselves can already do; a key can never grant more than its creator has.
• Mailbox filter — leave every box unchecked and the key gets whatever mailboxes you currently have access to. That’s a snapshot, not a live link: a mailbox you gain access to later isn’t added to an existing key automatically.
• Expiry — 30, 90 (the default), 180, or 365 days, a custom date, or never.

The token itself is shown exactly once, right after creation, then never again — not even to you. Copy it before closing that dialog. If you lose it, the only fix is revoking the key and making a new one.

One more thing worth knowing: no matter how broad a key’s scope, it can never be used to manage other API keys. That’s not a scope you can grant — it’s blocked structurally, so a leaked key can’t mint itself replacements or lock you out.

Webhooks

Settings → Webhooks. Real-time HTTP notifications to your own endpoints when conversations and customers change. Three tabs.

Endpoints

Each endpoint is a URL, a set of event types to send it, and an active switch. Thirteen event types exist, covering conversations (created, customer replied, note added, status changed, assignee changed, subject changed, moved, merged, deleted, plus a couple more state changes) and customers (created, merged, deleted) — at least one has to be checked to save.

Every endpoint gets a secret, shown masked with a reveal toggle and a copy button. Rotate replaces it immediately — no grace period where both the old and new secret work, so update your receiver in the same breath you rotate.

If deliveries to an endpoint fail 15 times in a row, Held Open disables it automatically and sends one admin alert (not one per failure). Nothing retries again on its own after that — fix whatever’s wrong with the receiver, then flip it back on from here.

Deliveries

Every delivery attempt, filterable by endpoint, with its event type, status, attempt count, and time. Each row has a Redeliver button for manual replay, and opens a detail view of what was actually sent.

Verify

Copy-paste signature-verification snippets (Node.js, Python, Go, PHP). The signature is HMAC-SHA256 over the raw request body, sent as X-HeldOpen-Signature: sha256=<hex> — verify against the bytes as received, before any JSON parsing. Re-serializing the payload changes its bytes and breaks the check, which is exactly the mistake this tab’s own snippets are written to avoid.