Use API keys and webhooks

Create an API key

Under API keys, select Create key. Give the key a Name that says where it's used, such as Zapier, so you know what breaks if you revoke it. Under Access, choose Read only, Full access, or Choose (1) to tick scopes one by one. Then select Create key (2).

Copy the key

Darwin shows the key once. Select Copy and store it where your code reads secrets, never on a website or in a repository. Then select Done. Keys start with dk_live_.

Check or revoke a key

Each key shows its name, its first characters, how many scopes it has and when it was last used. Select Revoke and confirm to stop a key at once. Anything using it stops working, and this can't be undone. A revoked key stays in the list, marked Revoked.

Add a webhook endpoint

Under Webhooks, select Add endpoint. Enter the URL (1): an HTTPS address that answers with a 2xx status within 10 seconds. Leave Choose events to tick the events you want, or pick All events, then select Add endpoint (2).

Darwin then shows the endpoint's signing secret once. Copy it so your server can check that each event really came from Darwin. Darwin posts each event to your URL, signed, and retries for three days.

Check deliveries

Each endpoint shows its address, its events and whether it's On, Off or Failing. Open its menu (···) and select Deliveries to see each event Darwin sent, with its attempts and your server's answer. Send again sends one again.

The same menu has Send test event, Show signing secret, Rotate signing secret (the old secret keeps working for 24 hours), Switch off (events are kept for 30 days) and Delete.

Identify signed-in visitors

If people sign in to your website, Website identity lets the chat know who they are. Select Create secret and copy the secret to your server. Then, on pages where a visitor is signed in, call Darwin("identify", …) with their email and name, plus a userHash your server makes from their email with the secret (HMAC-SHA256). Darwin checks the signature and links the chat to their contact.

Replace secret makes a new one; signatures made with the old secret stop working at once. The browser SDK reference has the details.

See recent requests

Recent requests lists the last 50 calls made with any key over the past 30 days: the status, the request, the key, how long it took and when. Use it to check that a tool is calling Darwin, or to find a failing call and its error.