API keys and webhooks

Account owners can read their own calls, appointments and messages through the API, and subscribe to events by webhook. Open More, then Developers. The full reference is at API documentation.

Create an API key

1. Under API keys, type a Key name, such as the tool that will use it.
2. Press Create API key.
3. Copy the key now with Copy. It is shown once and cannot be shown again.
4. Send it as a header: Authorization: Bearer followed by the key.

To stop a key working, press Revoke next to it. Each key is limited to 120 requests per minute. The data endpoints are read-only.

Add a webhook

1. Under Webhook endpoints, enter your Endpoint URL. It must be a public HTTPS address.
2. Tick the Events you want: call.completed, appointment.booked, appointment.cancelled, emergency.flagged.
3. Press Add endpoint.
4. Copy the signing secret. It is shown once.

Verify each delivery

Each delivery carries an Rw-Signature header in the form t=timestamp,v1=signature. To check it, compute an HMAC-SHA256 of the timestamp, a dot, and the raw request body, using your signing secret. Compare it to v1 with a constant-time comparison, and reject deliveries whose timestamp is more than five minutes old. Return a 2xx status quickly. Failed deliveries are retried with backoff.