Connect your own tools. API keys read your leads; webhooks tell your systems the moment something happens, signed so they can trust it. Keys and signing secrets are shown once, when you create them.
Active keys
1
Endpoints on
1
Sending
On
API keys
Send the key as "Authorization: Bearer <key>". GET /api/v1/leads lists your 100 most recent leads (add ?limit= and ?stage=), and GET /api/v1/leads/<id> reads one.
Reporting sheet
wpk_abcdefgh2345_... · leads:read
ActiveLast used 2026-10-03.
Webhook endpoints
Each event is a JSON POST with a stable id, so you can drop duplicates. Check the "Well-Signature" header: t=<seconds>,v1=<hex HMAC-SHA256 of "t.body" under your signing secret>, and refuse anything older than five minutes. Failed deliveries are retried for about a day.