Authentication
Create a key in Settings → API. Keys are scoped to a workspace and to a permission set — read-only keys exist and should be the default for anything that only reports. Send it as a bearer token; the key is shown once and stored hashed.
Rate limits
10,000 requests per hour on Business, 2,000 on Team. Every response carries the remaining budget and the reset time in headers, so a well-behaved client never needs to see a 429.
Webhooks
- Subscribe per event type and per project.
- Every payload is signed — verify the signature header against your endpoint secret before trusting the body.
- Failures are retried three times with exponential backoff, then parked in a delivery log you can replay.
- An endpoint failing for 24 hours is disabled and the owner is emailed.
Respond 2xx within five seconds and do the work asynchronously. A slow endpoint is treated as a failed one.
Did this answer your question?
If not, write to support and quote this page. Median first reply is under two hours on weekdays.