Use API keys and webhooks safely

API keys

Open Integrations → API.

Go to documentation opens the API reference at docs.signalist.io.
Create new API key asks for a name. The key is shown once, in Your new API key: copy it with Copy to clipboard and store it in a password manager or secret store. You cannot see it again.
The table lists your keys by name, the first characters of the key, and Issued at. Revoke switches a key off for good.

A key acts for your whole workspace and has no scopes or expiry date. So:

create one key per system or integration, named after it;
never paste a key into an email, chat, ticket, or code repository;
to replace a key, create a new one, switch your system over, then Revoke the old one;
if a key may have leaked, revoke it immediately.

Webhooks

Webhooks send leads from a list to a URL of yours, for example to start a workflow in another tool.

Create a webhook

Open Integrations → Webhooks and click Create new webhook.
Enter a Name and the Webhook URL.
Switch on Receives data after workflow is completed if your system sends data back; then name the custom columns it is written into.

Send leads to it

In a list's settings, under Advanced settings → Send leads to a webhook, choose the webhook and when leads are sent: all found leads, all leads including not found, all found and unsure leads, when a lead is assigned to a campaign, or when a lead replies. You can also select leads in a list and use Add to webhook.

Each lead is sent as its own JSON request, with the same fields as a list export.

When deliveries fail

Signalist retries a delivery when your endpoint does not answer or replies with a temporary error (408, 429, or 5xx): after 1 minute, 10 minutes, 1 hour, 6 hours, and 24 hours. Any other error is final.

The Status column shows Delivering, Retrying, Failing, Last delivery failed, Paused, or No deliveries yet.
After 3 deliveries in a row have failed for good, the webhook's creator and your Company Admins get a notice in the app and an email: "A webhook is failing".
After 100 in a row, the webhook is paused and nothing more is sent. Fix or replace the URL, then press Resume.
Leads that could not be delivered are not sent again automatically.

Because a delivery can be retried, your endpoint may receive the same lead twice. Handle this on your side, for example by matching on the lead's email or LinkedIn URL.

Keep webhooks safe

Use an HTTPS URL.
If your endpoint needs a secret, include it in the URL. Signalist does not log the query string.
Accept only the fields you need and check them before using them.

AI assistants (MCP)

The MCP Server lets an AI assistant such as Claude work with your Signalist data. There is no key to paste: the assistant opens a Signalist page, Connect an AI application, where you click Connect. It then acts as you, with your permissions. It never sends messages to real people and cannot activate campaigns.

The assistant can also answer questions about your results and what needs attention, for example "How did my campaigns do last month?" It reads:

the Analytics figures: outreach KPIs for the lists, campaigns, and period you name, the overview per list and campaign, your top campaigns by reply rate, each sender's daily activity and limits, and the monthly activity of your trackers' signals;
the Campaigns overview figures, if your workspace has the Campaigns overview;
the issues your Dashboard shows, such as a disconnected LinkedIn or email account or a list that finds no results, each with a short note on how to fix it.

These figures come from the same calculation as the app, so they match the Analytics page for the same filters. As in the app, the Analytics figures need access to Analytics.

To disconnect, go to Personal settings → Connected Accounts → Connected AI applications and click Disconnect. MCP access is enabled per workspace; if you see "MCP access is not enabled for your company", contact your Signalist contact.

Troubleshooting

Problem	What to do
An API request is rejected	Check that the key is sent in the `api-key` header and has not been revoked.
A webhook shows Failing	Check that the URL is reachable and answers with a 2xx status.
A webhook is Paused	Fix or replace the URL, then press Resume. Leads that failed are not resent automatically.
The same lead arrives twice	A delivery was retried. Make your endpoint ignore repeats of the same lead.
A key was shared by mistake	Revoke it now and create a new one.
The AI assistant cannot read Analytics figures	Check that your role has access to Analytics in Signalist.

Frequently asked questions

Can I limit what an API key can do?

No. A key acts for the whole workspace. Create one key per system so you can revoke each one on its own.

How do I rotate a key?

Create a new key, switch your system to it, then revoke the old key.

Are failed webhook deliveries retried?

Yes, up to five times over 24 hours for temporary errors. After that the lead is not sent again automatically.

Can the AI assistant send messages?

No. It works with your data but never sends messages to real people and cannot activate campaigns.

Do the assistant's numbers match the Analytics page?

Yes. The assistant reads the same figures the Analytics page shows. Ask for the same lists, campaigns, and period to compare them.