API keys and signed webhooks

API keys

Owners and admins create keys in Settings → Developers. A key is shown once; we store only its hash, so if you lose it, revoke it and create another.

• A key belongs to one workspace and acts as a member of it: it can import leads, create and run campaigns, read the inbox and reply. It can't manage the team, billing, integrations or other keys.
• Send it as Authorization: Bearer oa_live_…. The limit is 600 requests a minute per key.
• Revoking a key stops it within a minute.

Webhooks

Add an endpoint in Settings → Developers → Webhooks and choose events: connection.accepted, reply.received, reply.classified, lead.finished, email.found. Each delivery is a JSON POST with the lead, the campaign and the event's data.

• Answer with any 2xx within 15 seconds. Redirects aren't followed.
• Failures are retried about 8 times over roughly two hours. A 4xx other than 408 and 429 isn't retried.
• Every attempt is in the delivery log, and you can retry one from there.
• In production, endpoints must use https and a public address.

Verify the signature

Every delivery carries X-Outreach-Signature: t=<unix seconds>,v1=<hex>. Compute HMAC-SHA256 of <t>.<raw body> with the endpoint's signing secret (shown once when you create it), compare it to v1, and reject timestamps older than 5 minutes. The full example is in the API reference.