All articles
Integration & Analytics

Use API keys and webhooks safely

Create scoped API access, protect keys like passwords, and test webhooks with non sensitive data.

Before you start

  • Define the intended outcome, owner, permissions, and source of truth.
  • Use a small non-sensitive test.
  • Record the current configuration before changing it.
  • Confirm workspace availability in the current UI.

Signalist product view for art-027 step 1.

Steps

  1. Open Company Settings and API & Webhooks.
  2. Read the linked technical documentation for the exact endpoint.
  3. Create one named key per integration and move it directly to a secret store.
  4. Test with an isolated test list or contact.
  5. Log timestamp, event ID, status code, and safe response metadata.
  6. Rotate or revoke keys when unused or exposed.

Signalist product view for art-027 step 2.

Safety checks

  • The correct workspace, object, view, period, or endpoint is selected.
  • Permissions, ownership, required fields, and protected data were reviewed.
  • The test result was checked in the destination or final dataset.
  • Credentials and internal evidence are not exposed.

Signalist product view for art-027 step 3.

Troubleshooting

ProblemSolution
Webhook arrives twiceUse an event ID and idempotent processing.
A key was sharedRevoke or rotate it immediately and inspect logs.
A request failsCheck endpoint, method, authentication, payload, and safe response details.

Frequently asked questions

Why should I test first?

A controlled test exposes mapping, permission, data, and ownership errors before broad impact.

Can I assume every workspace has this feature?

No. Use the current UI and confirmed provisioning.

What should screenshots hide?

Credentials, tokens, personal data, customer records, internal URLs, and identifiers.

Who should own the configuration?

Assign an accountable administrator and a business owner.

What should I document?

Purpose, scope, owner, fields or filters, test result, and review date.

When should I contact support?

When availability, saved state, permissions, or results remain inconsistent after a controlled check.