Both API keys and outbound webhooks live on one screen: the API Keys tile in Settings, which opens a page headed "API keys & Webhooks." If you land on the old /app/settings/webhooks URL, or open Webhooks from the command palette, you're redirected here with the Webhooks tab already selected — it isn't a separate page, just a second tab.
API keys tab
Click "Create API key," give it a Label (pick something memorable — it's what shows in the list afterward), and choose a Scope: Read-only (list and get on customers, appointments, and invoices), Read + write, or Admin. Only Read-only does anything different today — the REST API has no create, update, or delete endpoints yet, so Read + write and Admin keys can read the same three resources and nothing more; the write scopes are reserved for when write endpoints ship. Pick Read-only unless you have a reason not to. Click "Generate key."
The plaintext key is shown exactly once, in an "API key created" dialog. Copy it now into a secrets manager — 1Password, Vault, AWS Secrets Manager. Once you close that dialog, SalesThumb cannot show it to you again; if it's lost, the only fix is to revoke the key and generate a new one.
After that, the list view only ever shows an 8-character prefix followed by masked dots. The Copy button next to that masked row copies the prefix, not the full key — that's useful for confirming which key a script is pointed at, not for recovering the secret itself. To retire a key, click the trash icon and confirm; the confirmation text warns "Apps using this key will stop working," and there's no undo — a revoked key has to be reissued as a brand-new one.
Keys authenticate real requests to the REST API: send it as an Authorization: Bearer st_live_… header. The API is read-only — six GET endpoints (list and get-by-ID for customers, appointments, and invoices), scoped to your shop, at 300 requests per minute per key. A key that's revoked, past its expiration date, or belongs to a shop that has been deactivated is rejected (reactivating the shop makes the same key work again). Anything that needs to create or change data in SalesThumb can't go through the API yet; the full reference is at /docs/api/rest.
Webhooks tab
This is a full subscription manager. Click "New subscription," give it a Label, a URL (HTTPS only — the Create button stays disabled until the URL starts with https://), and check the events you want from the list, grouped by resource. Every delivery is signed per-subscription with HMAC-SHA256; verify it against the X-SalesThumb-Signature header using the signing secret, which is shown exactly once, right after creation, in its own "Save your signing secret" dialog — the same one-time rule as API keys.
Each subscription row shows its Active/Disabled state, the subscribed events, lifetime delivery and failure counts, and time since last delivery. Watch for the "Paused automatically" badge and the reason under the URL — failed deliveries are retried automatically for about a day and a half, and once every delivery to a subscription has failed for more than 24 hours SalesThumb pauses it and emails the owner, so a stale or unreachable endpoint won't sit silently failing without you noticing. Use "Send test" to fire a one-off event at any time, and click "Show recent deliveries" to expand a log of up to the last 50 deliveries per subscription, with status code, latency, an absolute timestamp, and an attempt number for each.
What's still a placeholder
The "API reference" tab lists the six live read-only endpoints; there are no write endpoints to list yet. The "Request log" tab is a stub: its own copy explains that request logs will land in the same data store the audit log uses, but the UI for browsing them hasn't been built yet.