Developer access and webhooks
Developer access is an optional User Center capability and its entry can be hidden by the current deployment. When available, it contains API keys and webhook endpoints for integrating BuildWhat with an external system.
API keys
Create a key only for the application or automation that needs it. Choose the narrowest scopes offered, give the key a recognizable name, and store the secret in your external secret manager. The full secret is shown only at creation; if it is lost, revoke it and create a replacement. Do not put it in a browser bundle, project source, ticket, or Agent message.
Send the key using the documented Authorization: Bearer header and the API version shown by the platform. Treat a 401 as an authentication problem and a 403 as a scope or organization authorization problem. Respect rate-limit and retry headers. For a mutation, preserve the same idempotency key when retrying the same command so it is not applied twice.
Webhook endpoints
Create an endpoint with only the event types your integration needs. Save the signing secret when it is displayed. Verify the signature over the raw request body and the timestamp exactly as documented, use a timing-safe comparison, and reject stale timestamps. Acknowledge quickly and process events asynchronously when the event can take longer than the provider timeout.
Delivery history and replay
Review delivery and attempt history for response status, retries, dead letters, and replay actions. Replays are a controlled recovery action and preserve the original event identity; make the receiver idempotent. Disable or delete an endpoint when its destination is no longer trusted, then rotate the secret at the receiver.
Audit and revocation
Key creation, scope changes, endpoint changes, and revocation can appear in security or audit history. Revoke immediately after suspected exposure and review dependent automations before creating a replacement.