> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lekalao.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API tokens and webhooks

> Give your applications access, and tell them what happens.

Two screens tie Lekalao to your other applications: **API tokens** so that they call Lekalao, **Outgoing webhooks** so that Lekalao calls them.

## API tokens

**Settings → API tokens → New token**.

<Steps>
  <Step title="Name it">
    One per application that uses it: "Online shop", "CRM". You will then
    know what to revoke the day one of them is compromised.
  </Step>

  <Step title="Choose what it may do">
    **Read**: look at lists, subscribers, campaigns, statistics. **Read and
    write**: also create, change, delete and send. Give the least you can.
  </Step>

  <Step title="Copy it straight away">
    **Your new token** is shown once only. Put it with the application's
    secrets (an environment variable, a vault), never in the code.
  </Step>
</Steps>

The list shows each token, what it may do, when it was created and when it was **Last used**. **Revoke** cuts it off at once.

A token works for the team it was created in, even if you move to another one in the browser afterwards. It acts with your rights in that team: if you become a viewer it can no longer write; if you leave the team it stops working.

<Tip>
  A **Read and write** token also serves as the password for the [SMTP
  relay](/developers/smtp-relay).
</Tip>

**Settings → Documentation** gives the address of your API and a first call ready to copy. The rest is in the [Developers](/developers/introduction) tab.

## Outgoing webhooks

Lekalao sends a signed `POST` request to your addresses when something happens.

**Settings → Outgoing webhooks → New endpoint**:

<ParamField path="Name" type="text" required>
  So that you recognise it: "Online shop".
</ParamField>

<ParamField path="Address to call" type="URL" required>
  A public `https://` address. Internal addresses (localhost, a private
  network) are refused.
</ParamField>

<ParamField path="Events" type="checkboxes" required>
  * **A subscriber is created** (`subscriber.created`)
  * **A subscriber confirms** (`subscriber.confirmed`)
  * **A subscriber unsubscribes** (`subscriber.unsubscribed`)
  * **A tag is added** (`subscriber.tag_added`)
  * **A tag is removed** (`subscriber.tag_removed`)
  * **A campaign is sent** (`campaign.sent`)
  * **An e-mail bounces** (`mail.bounced`)
  * **Someone reports an e-mail as spam** (`mail.complaint`)
</ParamField>

<ParamField path="Only for one list" type="list">
  **Every list** by default, or one of them.
</ParamField>

<ParamField path="Call this endpoint" type="switch">
  Switch it off to keep the settings without being called.
</ParamField>

### The signing secret

Each endpoint has its own **Signing secret**, shown underneath with a button to copy it. Every call carries the `X-Lekalao-Signature` header worked out with that secret: your application has to check it before believing the call. The code is in [Webhooks](/developers/webhooks).

### Calls we made

The log lists every call: date, endpoint, event, status. Open a row to see the **Payload** and your server's **Response**; **Send again** replays a call that failed.

<Warning>
  After 10 failures in a row, the endpoint is **Switched off** and Lekalao
  stops calling it. Fix your server, then switch **Call this endpoint** back
  on and send the missed calls again.
</Warning>

A call is a success when your server answers a `2xx` code within 15 seconds. Redirects are not followed.

## Provider feedback

Not to be confused with them: **Settings → Provider feedback** lists the calls **received** from your sending providers (bounces, complaints, deliveries). See [Provider feedback](/deliverability/feedback).