Skip to main content
Two screens tie Lekalao to your other applications: API tokens so that they call Lekalao, Outgoing webhooks so that Lekalao calls them.

​
API tokens

Settings → API tokens → New token.
1

Name it

One per application that uses it: “Online shop”, “CRM”. You will then know what to revoke the day one of them is compromised.
2

Choose what it may do

Read: look at lists, subscribers, campaigns, statistics. Read and write: also create, change, delete and send. Give the least you can.
3

Copy it straight away

Your new token is shown once only. Put it with the application’s secrets (an environment variable, a vault), never in the code.
The list shows each token, what it may do, when it was created and when it was Last used. Revoke cuts it off at once. A token works for the team it was created in, even if you move to another one in the browser afterwards. It acts with your rights in that team: if you become a viewer it can no longer write; if you leave the team it stops working.
A Read and write token also serves as the password for the SMTP relay.
Settings → Documentation gives the address of your API and a first call ready to copy. The rest is in the Developers tab.

​
Outgoing webhooks

Lekalao sends a signed POST request to your addresses when something happens. Settings → Outgoing webhooks → New endpoint:
​
text
required
So that you recognise it: “Online shop”.
​
URL
required
A public https:// address. Internal addresses (localhost, a private network) are refused.
​
checkboxes
required
  • A subscriber is created (subscriber.created)
  • A subscriber confirms (subscriber.confirmed)
  • A subscriber unsubscribes (subscriber.unsubscribed)
  • A tag is added (subscriber.tag_added)
  • A tag is removed (subscriber.tag_removed)
  • A campaign is sent (campaign.sent)
  • An e-mail bounces (mail.bounced)
  • Someone reports an e-mail as spam (mail.complaint)
​
list
Every list by default, or one of them.
​
switch
Switch it off to keep the settings without being called.

​
The signing secret

Each endpoint has its own Signing secret, shown underneath with a button to copy it. Every call carries the X-Lekalao-Signature header worked out with that secret: your application has to check it before believing the call. The code is in Webhooks.

​
Calls we made

The log lists every call: date, endpoint, event, status. Open a row to see the Payload and your server’s Response; Send again replays a call that failed.
After 10 failures in a row, the endpoint is Switched off and Lekalao stops calling it. Fix your server, then switch Call this endpoint back on and send the missed calls again.
A call is a success when your server answers a 2xx code within 15 seconds. Redirects are not followed.

​
Provider feedback

Not to be confused with them: Settings → Provider feedback lists the calls received from your sending providers (bounces, complaints, deliveries). See Provider feedback.