Skip to main content
Two screens tie Lekalao to your other applications: API tokens so that they call Lekalao, Outgoing webhooks so that Lekalao calls them.

​
API tokens

Settings → API tokens → New token.
1

Name it

One per application that uses it: “Online shop”, “CRM”. You will then know what to revoke the day one of them is compromised.
2

Choose what it may do

Read: look at lists, subscribers, campaigns, statistics. Read and write: also create, change, delete and send. Give the least you can.
3

Live or test

Switch on Test key for a token that sends nothing: transactional e-mails are logged without reaching a provider, campaigns cannot be sent, nothing counts against the allowance. It shows a Test badge in the list. See Test keys.
4

Copy it straight away

Your new token is shown once only. Put it with the application’s secrets (an environment variable, a vault), never in the code.
The list shows each token, what it may do, when it was created and when it was Last used. Revoke cuts it off at once. A token works for the team it was created in, even if you move to another one in the browser afterwards. It acts with your rights in that team: if you become a viewer it can no longer write; if you leave the team it stops working.
A Read and write token also serves as the password for the SMTP relay.
Settings → Documentation gives the address of your API and a first call ready to copy. The rest is in the Developers tab.

​
Outgoing webhooks

Lekalao sends a signed POST request to your addresses when something happens. Settings → Outgoing webhooks → New endpoint:
​
text
required
So that you recognise it: “Online shop”.
​
URL
required
A public https:// address. Internal addresses (localhost, a private network) are refused.
​
checkboxes
required
In three groups, each with its name in code underneath.Subscribers
  • A subscriber is created (subscriber.created)
  • A subscriber confirms (subscriber.confirmed)
  • A subscriber unsubscribes (subscriber.unsubscribed)
  • A tag is added (subscriber.tag_added)
  • A tag is removed (subscriber.tag_removed)
Campaigns and e-mails
  • A campaign is sent (campaign.sent)
  • An e-mail bounces (mail.bounced)
  • Someone reports an e-mail as spam (mail.complaint)
Transactional e-mails
  • A transactional e-mail is handed to the provider (transactional.sent)
  • A transactional e-mail is delivered (transactional.delivered)
  • A transactional e-mail bounces (transactional.bounced)
  • A transactional e-mail is reported as spam (transactional.complained)
  • A transactional e-mail is opened (transactional.opened)
  • A link in a transactional e-mail is clicked (transactional.clicked)
  • A transactional e-mail could not be sent (transactional.failed)
​
list
Every list by default, or one of them.
​
switch
Switch it off to keep the settings without being called.

​
The signing secret

Each endpoint has its own Signing secret, shown underneath with a button to copy it. Every call carries the Lekalao-Signature header worked out with that secret and the time of the call: your application has to check it, and refuse a call signed more than five minutes ago, before believing it. The code is in Webhooks.

​
Calls we made

The log lists every call: date, endpoint, event, status. A call that fails is tried again on its own, after 1 minute, 5, 30, 2 hours, 6 and 12: while it waits, its status is Trying again. Open a row to see its Event id, the next attempt, the Attempts made with your server’s code and how long each took, the Payload and your server’s Response; Send again calls once more, at once.
An endpoint that fails for 3 days in a row, without a single success, shows Failing since meanwhile, then is Switched off: Lekalao stops calling it, and the owners of the team receive an e-mail. Fix your server, then switch Call this endpoint back on and send the missed calls again.
A call is a success when your server answers a 2xx code within 15 seconds. Redirects are not followed.

​
Provider feedback

Not to be confused with them: Settings → Provider feedback lists the calls received from your sending providers (bounces, complaints, deliveries). See Provider feedback.