Developers
Integrate without weakening the model
The platform is built so an integration can never require handing us your plaintext. Here is how to work with that constraint rather than around it.
Principles
What the platform gives you
Key-based authentication
Scoped API keys issued per environment, rotatable at any time, and revocable instantly from the dashboard. Keys are shown once and stored hashed.
Webhooks for state changes
Signed webhook deliveries for subscription, audit, and incident events, with automatic retries and a replay tool for missed deliveries.
Encryption stays client-side
The API never exposes plaintext vault content, because the server never has it. Integrations operate on metadata, usage, and account state.
Sandbox first
Every account gets an isolated sandbox environment with seeded data so you can build and test without touching production records.
Getting started
Four steps to a first call
1. Request access
API access ships with the Business plan and above. Sandbox keys are available to anyone on request during the beta.
2. Create a scoped key
Generate a key limited to the resources you need. Read-only keys are the default; write scopes must be enabled explicitly.
3. Call the REST API
JSON over HTTPS, cursor pagination, ISO 8601 timestamps, and problem+json error bodies. Rate limits are returned on every response.
4. Subscribe to webhooks
Register an endpoint, verify the HMAC signature on every delivery, and respond within 5 seconds to avoid a retry.
Status and reliability
API availability is tracked publicly alongside every other component. Breaking changes are announced at least 90 days ahead and recorded in the changelog.