API keys and webhooks
Scoped keys with expiry and IP limits, and signed webhook deliveries you can verify.
Kicheza hupakiwa kutoka YouTube pale tu unapobonyeza cheza.
Step by step
After this video you can give another tool a key that reads or writes only what it needs, and send LumaKol events to your own endpoint with a signature you can check.
- 1
Create a key for one tool
Integrations → API & webhooks → Create key. Name it after the tool, not the person: that name shows in the list and in the security log. Tick only the permissions it needs, such as leads:read, leads:write, calls:read, users:read or webhooks:manage.
- 2
Add an expiry and IP limits
A key can have a date it stops working and a list of IP addresses it may be used from. Both can be changed later without changing the key.
- 3
Copy the key now
The key starts with lk_live_ and is shown once, straight after you create it. Only a hash is stored, so nobody can read it back; if it is lost, revoke it and issue a new one.
- 4
Make the first call
The page shows your base URL, and the key goes on every request as a bearer token. GET /ping answers with the workspace and the permissions the key carries, which proves the key, header and address before you write real code.
- 5
Add a webhook
Integrations → API & webhooks → Add webhook. The URL must be https and reachable from the internet. Tick the events you want, such as lead.created, lead.stage_changed or call.logged, then use Test to queue a sample delivery.
- 6
Verify the signature
Every delivery carries X-LumaKol-Signature: an HMAC-SHA256 of the timestamp, a full stop and the raw body, keyed with the signing secret that starts with whsec_. Recompute it over the bytes you received and reject anything that does not match.
- 7
Read the delivery log
Recent deliveries under a webhook shows each event, whether it went through, and the status code or error. Anything that is not a 2xx is retried several times over about sixteen hours, and X-LumaKol-Delivery stays the same across retries so you can ignore repeats.
- 8
Revoke a key when it is done with
Revoke stops everything using the key at once and cannot be undone. The list shows when each key was last used, which is the quickest way to spot one nothing needs any more.
Tips
- A dashboard that only displays numbers needs leads:read and nothing else.
- Answer a webhook with a 2xx as soon as you have the payload and do your own work afterwards.
- API keys are available on paid plans, not during the free trial.
Read the full guide
The written guide covers the same screens, with every setting explained, so you can follow along at your own pace.
- Connect your own software with the API and webhooksA key your tool uses to read and write leads and calls, and webhooks that push events to your own endpoint the moment they happen. Both live in Integrations → API & webhooks.
- DevelopersAPI and webhooks reference for your own software
- IntegrationsGoogle Ads, IndiaMART, portal emails, form tools and the API
More from Sehemu ya pili — iendeshe
- 11Calling hours, attempt limits and do-not-call4:35
- 12Masked numbers, recordings and exports4:39
- 13Notes, reminders and voice memos3:15
- 14Lead capture forms4:25
- 16Working calendar, shifts and attendance rules4:58
- 17Notifications, and the four you cannot mute3:51
- 18Build a morning call list with filters4:24
- 19Your profile, language and sessions3:49
- 20Follow-ups in Google, Apple or Outlook5:45
- 21Power Dialer: call a whole list from your phone1:42
- 22Power Dialer for teams: keep callers dialling1:44
Ipe timu yako CRM inayorekodi kila simu
Sanidi nafasi yako ya kazi na uanze kurekodi simu siku hiyo hiyo.
- Hakuna kadi inayohitajika
- Hadi wasimamizi 3 wasiopiga simu bure
- Simu kutoka SIM yako mwenyewe