API tokens and webhooks

4 steps · About 8 minutes

What you will finish with. A token your systems can call NexlyFlow with, and events pushed to your own server as they happen.

Who this is for. Developers, or anyone connecting NexlyFlow to another tool.

Create an API token

Open Integrations, give the token a label so you remember what uses it, and press Create token. Copy it immediately — it is stored hashed and never shown again. Send it as Authorization: Bearer <token>.

Add a webhook endpoint

Enter an HTTPS URL on your own server and tick the events you care about: message accepted, delivered, read, failed, and inbound replies. We POST a JSON payload to that URL whenever one of those happens.

Verify the signature

Every request carries a signature header computed as sha256=HMAC_SHA256(endpoint_secret, raw_body). Compute the same value on your side and compare before trusting the payload. The secret is shown next to the endpoint.

Check it is arriving

The Recent deliveries table under your endpoints shows each attempt with its HTTP status. A healthy endpoint shows “ok” and 200.

What a payload looks like

{
  "event": "inbound.received",
  "tenant": 6247,
  "sent_at": "2026-09-04T09:12:00+00:00",
  "data": { "from": "+65XXXXXXXX", "text": "Is this still available?" }
}

Treat a token like a password. Anyone holding it can read and write your workspace data. If one leaks, revoke it here — anything using it stops working immediately, so create the replacement first.

Retries

If your endpoint does not answer with a 2xx, we retry with increasing gaps. After repeated failures the endpoint is marked unhealthy so you can see something is wrong.