API keys and webhooks
Create API keys for your own tools and automations, connect Claude or ChatGPT, and send signed webhooks when contacts, quotes, invoices, jobs and bookings change.
Where it is
Settings for this
- Integrations → API & webhooks — API keys, webhook endpoints, delivery log
Open Integrations → API & webhooks. The Reference card shows the base address, a sample request and every endpoint (products, contacts, invoices, quotes, sales orders, jobs, bookings and stock).
Create an API key
- Under API keys, type a Key name (e.g. "Zapier").
- Tick Write access only if the tool needs to create or change records. Without it the key can only read.
- Press Create key and Copy it straight away. It's shown once.
- Send it as a Bearer token. Each key can make 120 requests a minute.
Revoke stops a key at once. The list shows when each key was last used.
Connect Claude or ChatGPT (MCP)
The Connect to Claude or ChatGPT box gives the address to add as a connector, with an API key. A read-only key only sees read tools.
Webhooks
- Press Add endpoint, enter the Endpoint URL and an optional description.
- Tick the Events: contact.created, quote.accepted, invoice.paid, job.completed, booking.created, meeting.booked, meeting.rescheduled, meeting.cancelled.
- Save and copy the signing secret. It's shown once.
Each event is signed in the X-BuildTrack-Signature header (a timestamp and an HMAC-SHA256 of the timestamp and body). Reject anything older than 5 minutes and de-duplicate on X-BuildTrack-Delivery.
Each endpoint shows Healthy, Failing, Paused, Switched off or No deliveries yet, with Send test and a menu: Edit, Rotate signing secret (the old one keeps working for 24 hours), Redeliver failed (the last 7 days), Delivery log, Pause and Remove.
Failed sends retry 8 times over about 42 hours. An endpoint that fails for 3 days straight is switched off and owners are emailed.
Delivery log
Every delivery for 30 days with its status (Queued, Sending, Delivered, Retrying, Failed, Not sent), tries and result. Tick Problems only. Open one to see the body sent and Redeliver it.
Who can do it
The page opens with View settings. Adding and changing webhooks needs Edit settings. Creating and revoking keys, webhook changes and secret rotations are recorded in the Audit log.
If something's not right
- "Turn the endpoint on first": a paused endpoint can't redeliver. Press Turn on.
- "Pick at least one event" when saving a webhook.
- A tool can read but not create or change records: POST and PATCH need a key with Write access. Create a new key with it ticked.