Both API keys and outbound webhooks live on one screen: Settings → API keys & Webhooks. If you land on the old /app/settings/webhooks URL, or open Webhooks from the command palette, you're redirected here with the Webhooks tab already selected — it isn't a separate page, just a second tab.
API keys tab
Click "Create API key," give it a Label (pick something memorable — it's what shows in the list afterward), and choose a Scope: Read-only (list/get on customers, appointments, invoices, no writes), Read + write (full CRUD on those same three resources), or Admin (read+write plus tenant-level operations). Click "Generate key."
The plaintext key is shown exactly once, in an "API key created" dialog. Copy it now into a secrets manager — 1Password, Vault, AWS Secrets Manager. Once you close that dialog, SalesThumb cannot show it to you again; if it's lost, the only fix is to revoke the key and generate a new one.
After that, the list view only ever shows an 8-character prefix followed by masked dots. The Copy button next to that masked row copies the prefix, not the full key — that's useful for confirming which key a script is pointed at, not for recovering the secret itself. To retire a key, click the trash icon and confirm; the confirmation text warns "Apps using this key will stop working," and there's no undo — a revoked key has to be reissued as a brand-new one.
One thing worth knowing before you build anything: the page's own subtitle says a REST API to use these keys against "is on the roadmap." The "API reference" tab documents the planned endpoints (base URL, methods, paths) as a preview, not something live today. Go ahead and generate keys and settle on a scope model, but don't wire up automation yet that expects to call SalesThumb's API with one.
Webhooks tab
This is a full subscription manager. Click "New subscription," give it a Label, a URL (HTTPS only — the Create button stays disabled until the URL starts with https://), and check the events you want from the list, grouped by resource. Every delivery is signed per-subscription with HMAC-SHA256; verify it against the X-SalesThumb-Signature header using the signing secret, which is shown exactly once, right after creation, in its own "Save your signing secret" dialog — the same one-time rule as API keys.
Each subscription row shows its Active/Disabled state, the subscribed events, lifetime delivery and failure counts, and time since last delivery. Watch for the "Auto-disabled (10 consecutive failures)" badge — SalesThumb automatically disables a subscription once it fails ten deliveries in a row, so a stale or unreachable endpoint won't sit silently retrying forever without you noticing. Use "Send test" to fire a one-off event at any time, and click "Show recent deliveries" to expand a log of up to the last 50 deliveries per subscription, with status code, latency, an absolute timestamp, and an attempt number for each.
What's still a placeholder
The "API reference" tab is a preview of planned REST endpoints, not a working API — treat anything shown there as a design reference, not a live integration surface. The "Request log" tab is a stub too: its own copy explains that request logs will land in the same data store the audit log uses, but the UI for browsing them hasn't been built yet.