API keys and webhooks

Everything is in Settings › Developers. For the full reference, click Open API docs at the top right of that page.

API keys

1. 1

   Click Create key, name it, choose Read only or Read and write, and pick when it expires

2. 2

   Copy the key and keep it safe. It's shown only once

3. 3

   Send the key in the Authorization header of every request

A key acts as you and can see and change only what you can in that workspace. Click Manage your keys to view, rename or revoke keys. Owners and admins see everyone's keys in the workspace and can revoke any of them.

Webhooks (tell other systems when something changes)

1. 1

   Click Add destination, enter the URL that will receive events, and choose events such as task created, task status changed, note updated or new comment

2. 2

   A test request is sent before saving. The destination must respond with a 2xx code

3. 3

   Keep the secret you get to check the signature of every request

Click a destination to see its delivery history, resend, or send a test request. If deliveries keep failing, the destination is turned off and you're notified in your inbox. Note content and private pages are never sent.

Incoming webhooks (let other systems send work in)

1. 1

   Click Create URL and name it after the system that will call it

2. 2

   Copy the URL into that system, such as GitHub Actions, Zapier or a form. The URL is shown only once

3. 3

   That system can create tasks, append to notes or comment, acting as the person who created the URL

Click a URL to see which requests came in, whether they worked and where they came from. If a URL leaks, click Create new URL and the old one stops working right away.