Keys and webhooks

The Developers section of each app holds its API keys, a reference you can call from the browser, and the webhook endpoints that receive its events.

Everything here is per app, under Developers in the app nav. This page covers what you do in the dashboard. Authentication, request formats and event payloads are in Authentication and Webhooks.

API keys

Developers → API keys (/apps/[appId]/developers/keys) shows the app's two keys. Your product sends one of them as Authorization: Bearer <key>.

Secret key: key_…. Full access to every route for this app. Use it from your server only, stored as OFFER_SECRET_KEY. Never ship it in browser or mobile code.
Public key: pub_…, also called the publishable key. Safe in browser and mobile code, for example as NEXT_PUBLIC_OFFER_PUBLIC_KEY. It reads an account's access and the pricing cards, and adds usage.

The page's What each key can do table spells it out:

Capability	Secret	Public
Read an account's access (…/namespaces/:id/plan)	Yes	Yes
Read pricing cards (…/plans/pricing)	Yes	Yes
Read and add usage (…/namespaces/:id/usage/*)	Yes	Yes, for any account
Lower usage (…/usage/:id/remove, a negative …/amount)	Yes	No
Read private plan meta (…/namespaces/:id/full-plan)	Yes	No
Create, update and delete accounts	Yes	No
Manage plans, entitlements, add-ons and incentives	Yes	No
Read analytics	Yes	No
Update or delete the app, regenerate keys	Yes	No

The public key isn't tied to one account. Anyone with it can add usage to any account by id. Track anything you bill on from your server.

The Connection section at the bottom shows the base URL your product should call, the app ID, and whether the dashboard is on the Hosted API or the Mock API (in-memory).

Regenerate a key

Click Regenerate next to a key, type the app's name and confirm with Regenerate key. The new key is shown in full once, with a reminder to copy it now.

The old key stops working immediately. Every caller still using it gets 401 errors until you deploy the new one.
Regenerating the secret key also revokes every account token. Tokens (act_…) are signed with the secret key, so the cancel flow SDK and anything else using a token needs a fresh one from your server.
Regenerating one key leaves the other unchanged.

Integration guide and API reference

Two pages help you write the integration against this app's real data:

Integration: /developers. Snippets filled in with this app's keys, IDs and base URL: environment variables, creating an account at sign-up, checking access, tracking usage, changing plans from billing webhooks, rendering the pricing page, a React SDK skill that a coding agent uses to copy the SDK into your app and wire it up, and an AI assistant context block to paste into any AI assistant.
API reference: /developers/api. Every endpoint, filterable by group and searchable by path or method. Each one has a Try it panel that sends a real request from your browser with the secret or public key, and asks before sending a destructive one.

Try it changes real data. Requests go to the API the dashboard is connected to. In mock mode they go to the dashboard's /api/mock, which resets on restart. The full list of routes is also in the Endpoint reference.

Webhook endpoints

Developers → Webhooks (/apps/[appId]/developers/webhooks) sends signed HTTP requests to your endpoints when something happens in the app, such as account.plan_changed, usage.limit_reached or cancel_flow.cancelled. It has three tabs:

Endpoints: Each endpoint with its events, status, success rate over 7 days and last delivery.
Event log: Every event in the app from the last 30 days, whether or not an endpoint received it. Filter by event type.
Events & signing: Every event type, and how to verify signatures.

Add an endpoint

Enter the URL and events
Click Add endpoint. Enter the Endpoint URL (plain http works for testing, use https in production) and an optional Description. Under Events to send, either turn on All events, which includes event types added later, or tick events by resource.
Store the signing secret
Open the endpoint and copy its Signing secret (whsec_…). Store it on your server as OFFER_WEBHOOK_SECRET and verify the webhook-signature header on every request. Webhooks shows how.
Send a test
Under Send a test event, pick an event type and click Send sample payload. The payload is marked "test": true, and a toast shows whether your endpoint accepted it. The delivery shows up in the log.

The endpoint page

Each endpoint has a page at /apps/[appId]/developers/webhooks/[webhookId]. The top shows Delivered, Failed and Success rate for the last 7 days, and Retrying for deliveries pending now.

Deliveries: The delivery log, filterable by Delivered, Retrying and Failed. Each row has the event, status, response code, attempts and time. Expand one to see the request body and your server's response, when the next retry is due, and a Retry now button for anything that hasn't succeeded.
Events: The events this endpoint receives, with an Edit events button.
Signing secret: Roll issues a new secret. The old one stops working immediately, so deliveries fail verification until you update OFFER_WEBHOOK_SECRET.

The … menu has Copy URL, Pause endpoint (or Resume endpoint) and Delete endpoint. Deleting drops pending retries and the delivery log.

Paused endpoints miss events. Events that happen while an endpoint is paused are never delivered later. The API also turns an endpoint off by itself when it answers 410 Gone. The page then says This endpoint was turned off until you click Resume.

Retry timing and the payload format are in Webhooks.

Connect Zapier

Zapier receives the same signed webhooks, so you can send Offer events to other apps without writing a server. Click Connect Zapier on the Webhooks page, or one of the ready-made recipes under Automate with Zapier, such as “Post to Slack when an account changes plan”.

Create a Catch Hook in Zapier
In Zapier, start a Zap with Webhooks by Zapier → Catch Hook. Leave “Pick off a child key” empty and copy the webhook URL Zapier shows you.
Paste the URL and pick the trigger
Paste the Catch Hook URL into the dialog and choose the event that triggers the Zap. The dashboard saves it as a webhook endpoint marked Zapier, subscribed to that one event, and sends a sample event right away.
Map the fields
Back in Zapier, click Test trigger to pull in the sample and map its fields. If the sample didn't arrive, check the URL and send another from the endpoint page.

Zapier doesn't check signatures, so you can ignore the signing secret for a Zapier endpoint. Turning the Zap off or deleting it makes Zapier answer 410 Gone, which turns the endpoint off. Turn the Zap back on, then resume the endpoint. More in Zapier.